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ABSTRACT 


The increasing mechanical reliability of Naval Aviation (NA) aircraft has made 
human error (HE) the leading cause of Class A and B flight mishaps. To increase 
understanding of the underlying causes of HE, the Naval Safety Center in Norfolk, VA, 
developed the Human Factors Analysis and Classification System (HFACS). The 
HFACS taxonomy consists of 17 types of basic HE. This HFACS taxonomy has been 
used as a data analysis tool to classify 141 Class A and B Naval Tactical Aircraft 
(TACAIR) flight mishaps (FM) from fiscal year (FY) 90 to FY97. The study shows an 
important relationship between Adverse Mental State and 12 of the 17 HE types in the 
HFACS taxonomy. Significantly, when one of these 12 HE types is cited in an FM, 
greater than 70 percent of the time, Adverse Mental State is also cited as a co-causal 
factor in the mishap. Two other HE types have this 70 percent co-causal factor 
relationship with 3 of the 17 HE types. Adverse Mental State has an important 
relationship to the majority of the HE types in the HFACS taxonomy, compared with 
other HE types. For this reason, Adverse Mental State merits further investigation and 


should be considered in the development of HE prevention programs for Naval Aviators. 
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EXECUTIVE SUMMARY 


Over the past decade, 80 percent of all Class A Naval Aviation (NA) Flight 
Mishaps (FMs) can be attributed to human error (HE) (Naval Safety Center, 1999). In 
response, the Naval Safety Center (NSC) has recently adopted the Human Factors 
Analysis and Classification System (HFACS) model and is studying HE more thoroughly 
(OPNAV 3750.6R). Previously, the NSC studied HE primarily by classifying it in a 
“who? what? and why?” format (OPNAV 3750.6R). This classification, not developed 
under any specific theoretical framework of human performance, proved difficult to infer 
any specific causes of HE to a FM (Shappel & Wiegmann, 1997). The recent 
introduction of the theoretically based HFACS by the NSC (1997) provides a sounder 
framework for the study of HE (Reason, 1990). 

The occurrence of HE has been studied considerably (Reason, 1990). Naturally, 
psychologists tend to study HE from the standpoint of their own psychological 
disciplines, which leads to conflicting views of the underlying causes of HE (Senders & 
Moray, 1991). Because of this variance in the different theoretical approaches to the 
study of HE, the U.S. Navy has invested a great deal of time and effort in the 
development of HFACS for the classification of HE in Naval Aviation (Shappel & 
Wiegmann, 1997). The basic aim in the study of accidents involving HE should be to 
prevent similar accidents from reoccuring by anticipating problems in similar situations 
(Pimble & O’Toole, 1982). 

There are four identified layers of causation in the HFACS model: 

1) Organizational influences composed of latent failures, 

2) Unsafe supervision composed of latent failures, 

3) Preconditions for unsafe acts composed of active and latent failures, 

4) Unsafe acts composed of active failures (OPNAV 3750.R). 

Active failures are those HEs the pilot has direct control over at the time of the FM and 


latent failures are causal factors which the pilot has no direct control over at the time of 


ix 


the FM. The four layers of causation are composed of 17 total types of basic HE that 
define the HFACS taxonomy. 

This study involves the analysis of an existing database of Class A and B flight 
mishaps among Naval Aviation Tactical Aircraft (TACAIR) citing HE as the primary 
causal factor in the flight mishap. In 1998, Naval Aviation Psychologists at the NSC took 
the Class A FMs from fiscal year (FY) 90 to FY98 and classified them according to the 
HFACS taxonomy. The Class B flight mishaps from FY90 to FY98 are classified 
according to the HFACS taxonomy by the author, using the Mishap Investigation Reports 
(MIRs) description of the causal factors in the FM. There were 122 Class A TACAIR 
flight mishaps and 19 Class B TACAIR flight mishaps from FY90 to FY97 categorized 
as human factors flight mishaps. For FY98, there were 12 Class A TACAIR FMs and 0 
Class B TACAIR FMs identified as human factors flight mishaps. 

The purpose of the data analysis is to determine any important relationships 
between the 17 basic types of human error in the HFACS taxonomy and to verify that the 
accident arrival rate for the Class A and B TACAIR human error flight mishaps 1s from a 
Poisson distribution. The development of a simulation model to analyze the predicted 
future occurrence of HE types in the HFACS taxonomy is accomplished. In order to 
explore the dataset and to analyze the sets of flight mishaps associated with each causal 
factor, the analysis of the sets consisted of studying the intersection of sets between 
causal factors. The most important relationships are found in multiple set intersections of 
HFACS HE types. It is here that “Adverse Mental State” is identified as an important 
causal factor. Adverse Mental State has an important relationship in 12 of the 17 basic 
types of HE in the HFACS taxonomy. When one of these 12 HE types is cited in an 
accident, greater than 70 percent of the time, the investigation also cites “Adverse Mental 
State” as a causal factor. 

By modeling accident and flight hours for FY90 to FY97 in a log linear model, the 
accident arrival rate is determined to be Poisson. The significance of “Adverse Mental 
State” is further established by the results of the simulation. The only important multiple 


HE types in the simulation were those paired with “Adverse Mental State.” Important HE 


types were determined to be significant if the 95 percent confidence interval calculated 
from the simulation run did not contain zero. 

Due to the inherent complexity of the study of human error, making 
recommendations for its reduction, based on a HE type that shows an important 
relationship with multiple HE types, is the best approach. Single HE type 
recommendations do not take into account the interaction that causal factors undoubtedly 
have in a flight mishap. Any program to reduce human error should concentrate on an 
influential HE type related to as many types of human errors as possible. This program 
should be a one- to two-hour program, requiring aviators to attend annual or semi-annual 
presentations to maintain their awareness of program issues. Given the Strong 
relationships between “Adverse Mental State” and the majority of the other HE types in 
the HFACS taxonomy, establishing a human error flight mishap awareness and reduction 


program based on “Adverse Mental State’ would be appropriate. 


x1 
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I. INTRODUCTION 


Over the past decade, approximately 80 percent of all Class A Naval Aviation 
(NA) Flight Mishaps (FMs) have been attnbuted to human error (HE) (Naval Safety 
Center, 1999). Although mechanical failure is an important causal factor in FMs, the 
accident rate for mechanical failure is decreasing. Apparently, HE has reached a plateau 
and shows no signs of change (Nutwell & Sherman, 1996). Various models and 
taxonomies have been used to study HE and its causes (Shappell & Wiegmann, 1997). 
These include cognitive information processing models, models of cognitive malfunction 
and models of unsafe acts. These models are essential for studying HE at the individual 
operator level; however, the study of HE must also include organizational, supervisory 
and environmental influences to allow the human factor analyst to understand such 
accidents in their entirety (Shappell & Wiegmann, 1997). 

As previously stated, the current Class A FM rate in NA has human factor 
accident rates attributable to pilot and supervisory error as high as 80 percent. This rate. is 
of great concern to the Navy which created a Human Factors Quality Management Board 
(HFQMB) to look specifically into reducing the rate of human factors accidents in NA 
(Nutwell & Sherman, 1997). The majority of Naval Aviation human error FMs occur due 
to the direct or indirect actions of pilots and their supervisors. Any reduction of FMs due 
to HE would result in savings in both lives and equipment. 

The Naval Safety Center (NSC) has recently adopted the Human Factors Analysis 
and Classification System (HFACS) model (OPNAV 3750.6R) to meet the requirement 
to study HEs more thoroughly. Previously, the NSC studied HE primarily by classifying 
it in a “who? what? and why?” format (OPNAV 3750.6Q). Because this classification 
was not developed under any specific theoretical framework of human performance, it 
proved extremely difficult to infer any specific causes of HE (Shappel & Wiegmann, 


1997). The recent introduction of the theoretically based HFACS by the NSC (1997) 


provides a sounder framework for the study of HE (Reason, 1990). The HFACS 
taxonomy for classifying HE allows for a clear representation of the root causal factors of 
HE in an accident. Once these factors are identified, they can be studied in a cognitive 
psychological context. More importantly, potential intervention strategies can be 
evaluated based on the factors identified. The future impact on accident frequency and 
costs can be assessed using intervention strategies. In order to develop specific 
intervention strategies, One must determine if any of the identified causal factors in the 
FMs are important. The intent of this thesis is to identify these important HEs in Naval 


Aviation FMs through statistical analysis and to recommend intervention strategies. 


A. BACKGROUND 


The Naval Safety Center, which is located at the Norfolk Naval Air Station, 
Virginia, has three directorates: aviation, afloat and shore safety, and five support 
departments (NSC, 1997). The directorates work both independently and as a team to 
help the Chief of Naval Operation and the Commandant of the Marine Corps prevent 
Operational FMs, promote safety, and monitor safety programs. Through their 
involvement in all phases of safety, the NSC develops recommendations for formulating 
safety policies to maintain the highest level of combat readiness. The prevention of HE 
has been identified as one of the biggest remaining challenges for NA safety (Nutwell & 
Sherman, 1996). With a thorough study of the HE involved in Naval Aviation FMs, 
safety policy can be developed, which would further the goals of the NSC. 

The NA directorate implements the Naval Aviation Safety Program (OPNAV 
3750.6Q) supervised by the Assistant Chief of Naval Operation (Air Warfare). The NA 
directorate maintains a repository for all reports and related data for aircraft FMs and 
conducts NA statistical research, studies, special projects, analyses and compilations of 
aircraft FMs (NSC, 1997). The Naval Aviation Safety Program also directly or indirectly 
assists in investigations into hazards and FMs. Their purpose is to preserve human and 
material resources through policies that prevent similar FMs and eliminating known 


hazards. NSC personnel also conduct safety inspections and surveys at operational 


commands to evaluate the command’s safety programs and practices and to make 
recommendations for improvements. 

Previous Naval Postgraduate School (NPS) theses in support of the NSC found a 
relationship between human factors and accident causation (Lacy, 1998; Schmorrow, 
1998; Sciretta, 1999; Teeters, 1999). These theses demonstrated that analyzing human 
factors is a highly relevant issue to reducing all Naval Aviation flight mishaps. Lacy 
(1998) examined major mishaps afloat, Sciretta (1999) looked at electrical mishaps 
afloat, Schmorrow (1998) studied reportable NA maintenance related mishaps and 
Teeters (1999) contrasted major and minor maintenance related mishaps with one Wing. 
The common thread between each of these studies is the conclusion that human factors 
account for a large majority of Naval mishaps when the causal factors involved in the 
accidents are studied. Each author successfully modeled arrival rates of human error 
accidents and subsequently hypothesize the projected monetary savings to the Navy by 


varying the accident arrival rate in the models. 


B. OBJECTIVES 


The primary purpose of this study is to conduct a Statistical analysis to identify 
patterns in NA Class A and B TACAIR human factor flight mishaps. Moreover, the 
author, after identifying these patterns, will determine which patterns warrant further 
analysis. Then through a simulation model, these patterns will be evaluated for statistical 
significance. Finally, the author will identify and evaluate effective intervention 


Strategies. 


Gc. PROBLEM STATEMENT 


Currently a formal process of studying HE in NA has not been fully integrated 
into the investigation of flight mishaps. The validation of the HFACS classification 
taxonomy, through statistical analysis, may emphasize the importance of formally 
integrating HFACS into the accident investigation process. By studying Class A and B 


flight mishap Mishap Investigation Reports (MIRs), one can model the occurrence of 


aircraft FMs, can identify potential intervention strategies for aircraft FMs due to HE, and 
can forecast these strategies impact on future FM frequencies. By employing current 
human factors theory, including the classification of all human factors FMs studied using 
the HFACS taxonomy, and by applying the data analysis to the NA Tactical Aircraft 
(TACAIR) FMs, intervention strategies can be proposed. This would save both lives and 
valuable resources through a reduction of human factors flight mishaps. This study 
investigates the following questions: 

1) Can human factor trends be identified using the HFACS taxonomy of HE? 

2) Can potential intervention strategies be identified for the primary human 

factors trends found? 

3) Can the intervention strategies identified be used in the Class A and B FM 


models to evaluate their subsequent impact on FM frequency and costs? 


Dy: DEFINITIONS 


This study uses the following definitions (OPNAVINST 3750.6Q, 1991): 

1) Class A Mishap. A mishap in which the total cost of property damage 
(including all aircraft damage) is $1,000,000 or greater; or a naval aircraft is destroyed or 
missing; or any fatality or permanent total disability occurs with direct involvement of 
naval aircraft (OPNAVINST 3750.6Q, 1991). 

2) Class B Mishap. A mishap in which the total cost of property damage 
(including all aircraft damage) is $200,000 or more, but less than $1,000,000 and/or a 
permanent partial disability, and/or the hospitalization of five or more personnel 
(OPNAVINST 3750.6Q, 1991). 

3) Tactical Aircraft (TACAIR). The following Naval Aircraft are considered 
as TACAIR for this study: A-4E, A-4F, A-4M, A-4Q, A-6A, A-6B, A-6E, A-7B, A-7C, 
A-7E, A-7F, AV-8B, AV-8D, EA-6A, EA-6B, EA-7L, F-4A, F-4G, F-4J, F-4N, F-4S, F- 
5E, F-5F, F-9F, F-14A, F-14B, F-14C, F-14D, F-16N, F-18A, F-18B, F-18C, F-18D, F- 
18E, F-18F, KA-6B, KA6D, OA-4M, RF-18A and RF-4B. 


E. SCOPE AND LIMITATIONS 


The scope of this study encompasses all Naval TACAIR Class A and B FMs 
citing human factors as the primary causal factor of the FM between October 1, 1989, and 
September 30, 1997. It examines the classification of HE in Naval TACAIR FMs, using 
the HFACS taxonomy. An introduction to the history of the study of HE, the genesis of 
the NSC’s HFACS, and the use of human factors in Naval Aviation accident investigation 
is discussed in Chapter Il. Chapter III provides a framework of the methodology used in 
the study. Chapter IV covers a data analysis of the HFACS taxonomy, a modeling of the 
accident arrival rate, and a modeling of the rates of future HE occurrences, as defined by 
the HFACS taxonomy. Concluding the study, Chapter V contains a research summary, 


discussion and recommendations. 
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Il. LITERATURE REVIEW 


There has been considerable study into the occurrence of human error (HE) in 
terms of why we make mistakes that lead to accidents (Reason, 1990). Though there has 
been much interest in HE by many researchers and authors, there is a lack of agreement in 
the field of HE in regard to a proper definition of error (Senders & Moray, 1991). This 
lack of agreement is an issue, which makes the study of HE difficult. 

Psychologists tend to study HE from the vantage point of their psychological 
disciplines, which leads to different views of the underlying causes for human error 
(Senders & Moray, 1991). These differences in the study of human error create 
alternative theoretical avenues from which the study of HE is approached. Numerous 
industry specific taxonomies are applied by researchers to their own areas of interest. 
Most of these taxonomies are based on the concept of endogeneous and exogenous causes 
of HE, those that have their origin, inside or outside the person (Senders & Moray, 1991). 
Even with the commonality of endogeneous and exogenous causes of HE, taxonomies 
cannot be easily transferred from one area of study to another. For example, taxonomies 
used to model accidents in the nuclear energy industry are difficult to transfer to the study 
of NA accidents. The theoretical underpinnings of these different taxonomies often do 
not allow them to be compared directly with other taxonomies, leading to slight 
theoretical disagreements regarding the various models of HE causation. 

Because of the variance in the different theoretical approaches to the study of HE, 
the U.S. Navy has invested a great deal of time and effort in the development of a 
specialized taxonomy for the classification of HE in Naval Aviation (NA) (Shappel & 
Wiegmann, 1997). In pursuit of this specialized taxonomy and to insure consistency of 
internal studies into human error, the Navy has decided to base its studies of HE on “The 
Taxonomy of Unsafe Operation” (Shappel & Wiegmann, 1997) a single taxonomy of HE 


based on extensive research into human behavior appropriate to the Naval Aviation 


community. This classification system is currently called the Human Factors Analysis 


and Classification System (HFACS). 


A. HUMAN ERROR 


The basic aim in the study of HE accidents should be to prevent similar accidents 
from occurring again and anticipate and avert hazardous situations (Pimble & O’ Toole, 
1982). For an empiric study of human error, a commonly accepted definition of HE must 
exist. This has been one of the issues plaguing the study of human error. Few 
researchers define human error identically. Some authors do not even accept a definition 
for human error (Senders & Moray, 1991). Their beliefs are grounded in Freudian 
psychology, believing that there are no accidental errors--everything is either 
subconsciously or consciously driven (Senders & Moray, 1991). However, the majority 
of those who study human error have a more tangible definition of HE. They do not view 
human error as a subconciously driven expression of the individual, but simply as a 
mismatch of intention and action (Senders & Moray, 1991). 

For the Freudian camp, the explanation of human error would follow this manner 
of logic: An actor in a given scenario is supposed to lower the landing gear of an aircraft 
in-flight, but unintentionally (at least consciously) fails to do so and lands gear up. Since 
Freudian theorists do not accept unintentional causal factors, the actor must have willfully 
done this subconsciously (Reason, 1990). Why would the actor fail to perform such a 
vital action in the landing sequence? A Freudian explanation would proceed as follows: 
Internally, the actor has a subconscious conflict between the inherent nsk of the NA 
profession and a long-term commitment to his or her family. Consciously, the actor 
cannot arbitrate between these conflicting issues. As a result, subconsciously, the actor 
decides to “quit” flying one way or another. The next day while he is landing, the actor’s 
subconscious intentionally wills the conscious to forget to lower the landing gear. All 
this occurs because the actor could not consciously decide to quit flying even though in 


reality his or her preference is to quit. Fortunately, the majority of those who study HE 


do not base their studies on Freudian philosophy. This approach to the study of human 
error would make predicting HE extremely complex, if not impossible. 

Certainly, although the majority of authors do not agree on a proper definition for 
human error, they at least accept the existence of HE (Senders & Moray, 1991). 
Generally they accept a broad-based definition; “When one interacts with machines or 
complex systems, one frequently does things contrary to intention” (Senders & Moray, 
1991). Many of the differences between researchers occur in the taxonomy of human 
error which they use 1n their study. 

Kollarits (1937), examining approximately 1,200 human errors committed by 
himself, his wife and his colleagues, conducted one of the earliest studies of human error. 
Proposing an initial fourfold classification based on the superficial appearance of the HE, 
Kollarits used a taxonomy of substitution, omission, repetition and insertion. Kollarits 
observed that sometimes assigning a HE unequivocally to a single category was difficult 
(Senders & Moray, 1991). This foreshadowed the classifying of HE types for most of the 
mainstream practitioners. Unlike the Freudian approach, the mainstream approach to the 
study of human error breaks the causal factors of HE into multiple parts, based upon the 
conscious decisions made by actors in the decision-making process. 

Breaking this human error into its atomic parts is the root of many differences in 
the definition of human error. The definition of a human error certainly depends on the 
point of view of the person judging whether a HE has occurred (Park, 1995; Senders & 
Moray, 1991). The individual committing the human error recognizes the error only after 
it has occurred thus, the individual’s perspective is only hindsight. Herein lies a portion 
of the dilemma of defining human error. What if the HE occurs without creating 
instability in the system? In this situation, many researchers studying human error would 
contend that no HE had occurred (Senders & Moray, 1991). 

Recalling the landing gear example discussed earlier, reconsider this incident 
following the more mainstream ideals of human error. What if the actor decides to lower 
the landing gear, reaches for the landing gear, and grabs it, but then the aircraft’s airspeed 


enters his peripheral vision. This cues the actor to focus on the airspeed, the actor notices 


that the airspeed is too fast to lower the landing gear safely. At this point, the actor delays 
lowering the gear until the aircraft slows to the correct airspeed to lower the gear. Has a 
HE been made in this circumstance? Those who would say “yes” would contend that a 
HE had occurred because the actor had erred simply by reaching for the landing gear. 
Those researchers who would argue that a human error had not occurred in this situation, 
approach HE from a less rigid viewpoint (Senders & Moray, 1991). They would say that 
since the actor recognized this incorrect action before it adversely affected the system, a 
human error had not occurred. 

For a thorough in-depth understanding, the best study of human error would be to 
approach the study of HE from the purists’ view (AGARD, 1998). At a minimum, such a 
study would require each aviator to maintain a human error diary of every flight (Lourens, 
1990). This study also could not be short-term. It would need to follow aviators 
throughout their careers. Obviously, not only would this study be full of inaccuracies, 
due to self-reporting, but collecting and analyzing all this data would be highly expensive. 
Moreover the aviators would likely be disinclined to report their faults (AGARD, 1998). 
Such a study would most likely be received with a great deal of distrust. 

Researchers of human error in Naval Aviation must therefore rely on data 
gathered on reportable incidents of HE (AGARD, 1998), 1.e. required to be reported by 
the letter of the law. Consequentially, they take the theoretical viewpoint of HE as having 
a tangible outcome, affecting the correct operation of the system. To ensure consistent 
results, either an actor or an external analyst needs a model of task performance in order 
to decide whether an action has been correctly executed. This leads to HE being defined 
as a human action that fails to meet an implicit or explicit standard. A HE occurs when a 
planned series of actions fail to achieve a desired outcome and when this failure cannot be 
attributed to the intervention of some chance occurrence (Senders & Moray, 1991). 

In aviation, a human error can be defined as an action or event with an effect that 
is outside specific tolerances required by a particular system. The definition does not 
directly refer to actions of the pilot but only to the consequences of the pilot’s actions 


(Reason, 1990). Even if the actor intended to do “A” and instead did “B,” there would 
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have been no human error unless the system had exceeded acceptable limits (Senders & 
Moray, 1991). Clearly, if an accident does not occur, researchers cannot study it. In 
many of the taxonomies of human error, the researcher’s studies start here. Their 
taxonomies are used to Separate these accidents into specific types of human error and to 
study them to provide insight into preventing future HE accidents. 

Human error can be seen as a necessary and natural part of skill development 
(Lourens, 1990). Human error, as such, is always part of control operations that include 
feedback. In such situations, HEs are neither good nor bad (Wickens, 1991; AGARD, 
1998). When human errors become too large, badly timed or hazardous, they become 
“grievous human errors.” A “grievous human error’ occurs when the actor exceeds safe 
Operating tolerances (Senders & Moray, 1991). In order to advance in skill and 
knowledge people must commit errors to advance their abilities. Human error is needed 
for learning, adaptating, creating and surviving. Human error may result in a destructive 
outcome, but there may be virtue in these HEs if they result in learning and their negative 
consequences can be minimized. Human errors are the inevitable results of actors 
creatively experimenting with their environment and are necessary for gaining knowledge 


and improving one’s skills (Neville, 1991). 


B. TAXONOMIES 


If HE is to be studied empirically, there must be a commonly accepted theory of 
normal behavior (O’Hare, Wiggins, Batt & Morrison, 1994). In a passage from the 
Principles of Psychology (1890) William James said, “Habit diminishes the conscious 
attention with which our acts are performed.” In this early passage, James is referring to 
“schema,” an important part of understanding normal behavior. Schema is one of two 
important processes mentioned by Reason as important when developing a framework so 
that one can understand human cognition (normal behavior) (Reason, 1990). Reason 
mentions two control modes for cognition: attentional and schematic. These two modes 
are found in most frameworks that outline human cognition and HE. The attentional 


mode is defined as conscious processing and the schema mode is defined as automatic or 
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unconscious behavior (Wickens, Gordon & Liu, 1997). Cognitive activities and normal 
behavior in everyday tasks are guided by a complex interplay between these two modes of 
cognitive control (Reason, 1990). 

The “attentional-control-mode” is related to working memory and consciousness 
(Wickens, 1991). This mode 1s limited, sequential, slow, effortful and difficult to sustain 
for more than brief periods (Dosher & Sterling, 1986). It can be thought of as the 
chalkboard we work on cognitively. A very limited amount of information is assimilated. 
This process is controlled in a conscious and largely voluntary manner. Since more than 
one high-level activity may be available for processing at any one time, the selection 
process used by the operator becomes very important. Much of the attentional mode’s 
work is concerned with setting future goals, with selecting the means to achieving them, 
with monitoring progress toward their objectives, and with the detection and recovery of 
HEs (Reason, 1990). 

The “schematic-control-mode” is not consciously brought to bear on activities 
(Wickens, Gordon & Liu, 1997). As William James said, “Habit diminishes our 
conscious attention to a task.” This is the development of the operator’s schema. When 
people intend to do something, they think about their intended actions, called “planning 
ahead” or “forethought.” For a pilot who has flown a particular flight profile numerous 
times, actions become automatic (Bond, Bryan, Rigney & Warren, 1960). The schema 
developed by the aviator allows an increase in the efficiency with which the aircraft is 
flown. This allows the pilot to think ahead of the aircraft because he or she does not have 
to dwell on the minutia of action or reaction in the operation of the aircraft. 

As an example, the actor from the earlier example is flying and decides to enter a 
steep angle of bank. Early in an aviator’s career, this can be a difficult manuever, 
requiring the complete focus of the attentional contro] mode on this single task (Wickens, 
1991). This requires the actor to consciously recite a rote mnemonic to force attention 
from one flight instrument to the next to execute the manuever properly. For the novice, 
this manuever uses all the available resources of the attentional control mode. For the 


experienced actor such a manuever is barely noticed consciously, except for setting the 
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parameters correctly for the entry into the manuever (Hart & Sheridan, 1984). This 
manuever requires very little use of the actor’s attentional control mode, which is a 
limited resource, allowing these resources to be focused on planning issues instead of 
basic manuevers. For the expert, an organized unit of knowledge, the schema, is 
activated to accomplish the manuever (Reason, 1990). Many of the taxonomies on HE in 
some way incorporate these ideas of attentional control and a schematic control mode. 

A number of models have brought insight and value to the study of HE (Senders 
& Moray, 1991). James Reason provides a compilation of some of the most influential 
taxonomies in the study of human error (Reason, 1990). The Norman-Shallice model 
represents a family of action theories. Rasmussen’s “skill-rule-knowledge” framework 
models cognitive control processes. Rouse’s "fuzzy rule" model is based on the 
assumption that humans are not truly optimizers in their thought processes. Baar’s global 
workspace (GW) model focuses on interaction within working memory. Reason’s 
generic HE modeling system (GEMS) builds its structure around Rasmussen’s ideas of 
skill-based slips and lapses, rule-based mistakes, and knowledge-based mistakes for HE 
classification (Park, 1994). The Helmreich model attempts to go further in the study of 
HE by focusing outside of operator human error. Four concentric circles represent 
Helmreich’s model with operator error at the innermost circle, which is influenced by 
external factors in the outer circles. Each of these taxonomies has had an impact on the 
way human error is viewed in the particular industrial applications for which the 
taxonomy was developed. The study of HE in Naval Aviation draws a little from each 
but focuses mainly on the studies by Rasmussen and Reason for the development of an 
aviation specific taxonomy. The NSC’s Human Factors Analysis and Classification 
System (HFACS) uses theoretical constructs from both Reason and Rasmussen in 
modeling human error. 


1. Norman-Shallice’s Attention to Action Model 


Norman and Shallice developed an attention to action model, which provides for 


two kinds of control structures, horizontal threads and vertical threads (Norman & 
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Shallice, 1990). The model is based upon the idea that an adequate theory of human 
action must account for not only correct performance, but also for the more predictable 
varieties of human error. Systematic HE form and correct performance are seen as two 
sides of the same theoretical coin (Reason, 1990). 

The control system proposed by Norman and Shallice is clearly related to the 
attentional- and schema-control-mode view of human error (Norman & Shallice, 1990). 
The horizontal threads are each composed of a self-sufficient strand of specialized 
processing structures (schema). The vertical threads interact with the horizontal threads 
giving the means by which attentional or motivational factors can change the schema 
activation values. Horizontal threads govern habitual activities not requiring the need to 
receive constant attentional control, triggered by environmental input or previously active 
schemas. Higher level attentional processes come into play through the vertical threads, 
in unique or critical situations when currently active schemas are insufficient to achieve 
the current goal. This adds to or decreases schema activation levels to modify ongoing 
behavior. Norman and Shallice also include motivational variables which they view as 
influencing schema activation along the vertical threads, but motivational variables are 
assumed to work over much longer time periods than the attentional resources (Reason, 
1990). 

An example of the interaction between vertical and horizontal threads could be the 
previously discussed experienced actor flying into the airport traffic pattern. As the actor 
enters the landing pattern, active horizontal threads (schemas) allow the actor to control 
many variables without continuously monitoring them. Without warning, the actor 
notices flocks of birds in the aircraft’s flight path. In this critical situation, a vertical 
thread (attentional-control-mode) activates an evasive manuever schema contained in a 
horizontal thread. This allows the actor to execute quickly a senes of control 
manipulations, without having to use his or her attentional-control-mode, to avoid the 


hazard. 
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23 Rasmussen’s Skill, Rule and Knowledge System 


Like Norman and Shallice’s, Rasmussen’s (1982) “skill-rule-knowledge” model 
of cognitive control mechanisms is also human error oriented. Rasmussen was more 
interested in studying fatal human errors specifically. The framework of the model is 
based on the study of those in supervisory control of industrial installations, particularly 
during emergencies in hazardous process plants. The highly familiar, “skill-mle- 
knowledge” framework originated from a verbal protocol study of technicians engaged in 
electronic trouble shooting in a study by Rasmussen and Jensen in 1974. 

Three levels of performance correspond to decreasing levels of familiarity with 
the environment or task (Reason, 1990). Skill-based performance is governed by stored 
patterns of behavior also known as schema (Park, 1994). The skill-based levels of action 
are vulnerable to failures of attention and memory. Rule-based performance is applicable 


to tackling familiar problems in which solutions are governed by stored rules of the type: 
if (state) then (diagnosis) or if (state) then (remedial action) 


(Wickens, Gordon & Liu, 1997). Rule-based performance is also comparable to Norman 
& Shallice’s interaction between vertical and horizontal threads, where the attentional- 
control-mode is used in identifying the problem to be solved and stimulating specific 
problem-solving schemas. An example of this would be a pilot’s reaction to an in-flight 
emergency. The pilot uses attentional resources in identifying the perceived emergency 
and responds with a practiced response, schema, to the identified emergency. 

Human errors at the rule-based level are typically associated with the 
misclassification of situations leading to the application of the wrong rule or the incorrect 
recall of procedures (Reason, 1990). Knowledge-based issues of HE come into play in 
novel situations for which actions must be planned on-line, using conscious analysis 
(attentional-control-mode) and stored knowledge (Wickens, Gordon & Liu, 1997). 
Human errorss at this level arise from resource limitation and incomplete or incorrect 


knowledge. With increasing expertise, the primary focus of control moves from 
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knowledge-based toward the skill-based levels but all three levels can co-exist 
simultaneously (Reason, 1990). 

According to Reason, Rasmussen’s major contribution in his model for the theory 
of HE in cognitive processes is how he theorizes the interaction of the operator’s 
cognition and the levels of human error (Reason, 1990). Rasmussen charted the shortcuts 
that human decisionmakers take in real-life situations, known as the “Step-Ladder” model 
(Park, 1994). Instead of a linear relationship in decision-making as most decision 
theorists had represented, Rasmussen’s model is analogous to a stepladder, with the skill- 
based activation and execution stages at the bases on either side and the knowledge-based 
interpretation and evaluation stages at the top. Intermediates on either side are the rule- 
based stages (Reason, 1990). Shortcuts may be taken between these various stages, 
usually in the form of highly efficient but situation specific stereotypical reactions. 
Where the observation of the system’s state leads automatically to the selection of 
remedial procedures, without the slow and laborious intervention of knowledge-based 
processing. This stepladder layout also allows for associative leaps between any of the 
decision stages. This strategy can also increase a person’s vulnerability to making HEs 
because the strategy is overly reliant on the appropriateness of past experience (Park, 
1994). 

Using, again, the previous actor as an example, human error can be looked at in 
terms of “‘skill, rule and knowledge” based cognitive processes. Skill-based errors will 
occur when the actor is in a familiar environment. As an example, the actor is taxiing an 
aircraft at his or her homebase (very familiar surroundings and routines). New 
construction, however, has rerouted the actor’s familiar patterns of returning to his 
squadron. After landing, the pilot turns onto the closed taxiway and damages the 


aircraft’s engine, due to debris on the closed taxiway. 
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Rule-based errors will occur when the aviator does not have a lot of experience in 
a variety of unique and common situations. Experienced aviator’s avoid rule-based errors 
because of his or her exposure to multiple experiences. Rule-based human errors are 


going to occur in the form: 


if (state) then (diagnosis) or if (state) then (remedial action) 


types of rule-based behavior. Knowledge-based errors occur when the aviator decides to 
execute a plan and the plan turns out to be inappropriate for the situation. An example is a 
poor approach choice in bad weather. Once the actor commits himself to the approach 
and enters the weather, his Skills may be exceeded and a human error flight mishap (FM) 
could ensue. 


3: Rouse’s “Fuzzy Rule’ Model 


Rouse (1981) in developing his “fuzzy rule” model attempted to bring computer 
based modeling of HE to bear on the problem of prediction. Rouse uses rules based upon 
concepts of artificial intelligence. The model attempts to model human cognition by 
trying to codify the way human memory encodes stores and retrieves a limitless set of 
schematic representations. Assuming that knowledge is based on a rule-based format, a 
necessary assumption for modeling an artificial intelligence system, Rouse distinguished 
two types of problem-solving rules: symptomatic strategy (S-rules) and topographic 
search (T-rules) (Reason, 1990). For Rouse’s decisionmakers, they can either use an S- 
rule or T-rule to solve a problem. For the S-rule, identification of the problem is derived 
from a match between local system cues and a stored representation of a pattern of 
indications of a failure state in the system. In keeping with the flavor of the artificial 
intelligence approach Rouse brings to the model, S-rules are frequently used in a rule- 


based form with some appropriate remedial diagnoses. 
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As an example of an S-rule, using the aviating actor from the previous example: 


if (the landing gear handle is down and all the lights are not illuminated 
for gear down indications), then (check the hydraulic pressure gauges). 


The T-rules need not contain any reference to specific system components but instead 
require access to a mental or actual map of the system. T-rules also require consideration 
of the structural and functional relationships between their constituent parts. An example 


of the T-rule is based more on a predicate calculus approach to the problem at hand: 


if (the functioning of X is faulty and X depends on Y and Z, and Y is known 
to be working), then (check Z). 


The use of S-rules and T-rules as the theoretical underpinning of his model allows for 
easy access to programming in artificial intelligence. A list of Rouse’s rules could easily 
be transferred to computer languages, such as LISP or PROLOG, and then used to model 
human behavior and from there if statistically significant, to predict HE in various 
situations. 


4. Baar’s Global Workspace (GW) Model 


Baar’s (1988) construction of his global workspace model is another that parallels 
the schema and attentional-control-mode research. Baar explains the multiple pairs of 
apparently similar phenomena that seem to differ in the fact that one is conscious 
(attentional) and the other is not (schema). Baar concentrates on what is termed the 
“global workspace,” a working memory that allows for interaction of specialist processors 
(Reason, 1990). These processors compete for access to the global workspace based on 
their current activation level. The operators’ consciousness reflects the current contents 
of the global workspace. Baar’s global workspace:-model is closely identified with short- 
term memory and the limited capacity components of the cognitive system, concentrating 
more on the attentional control mode discussed earlier and how it interacts with the 


schema. 


Baar’s Global Workspace model does not extend as far as the others but looks 
pnmarily at the attentional-control-modes and their interactions. Working memory is 
limited and the actor can only maintain a limited amount of information in Baar’s GW 
model. Let us take an example from our previous actor and look at it in terms of the GW, 
through which only a limited amount of information can be actively processed. If the 
actor is being given specific unfamiliar instructions while in flight, the majority of the 
total workspace available in the GW is used. If an event with a higher priority comes to 
the attention of the GW, such as a warning light, the warning light has a higher activation 
level than anything currently in the global workspace. This higher activation level 
displaces the currently active items in the global workspace and allows the GW to give 
full attention to the warning light. 


5. Generic Error Modeling System (GEMS) 


The Generic Error Modeling System (GEMS) by Reason (1990) is another rule- 
based type model using the ideas of attentional-control-modes and schema. Reason 
borrows heavily from Rasmussen’s “skill-rule-knowledge” model but additionally 
attempts to locate the possible origins of these basic HE types. The GEMS model 
addresses cognitive human error. By addressing the cognitive factors instead of 
environmental or context-related factors, one can expect that the human error 
classification in GEMS will be applied to the analysis of HE in a variety of industrial 
situations (Park, 1994). 

Reason distinguishes between three separate performance levels for the model, 
skill-based, rule-based and knowledge-based levels. Skill-based performance is based on 
sensorimotor performance, taking place without conscious control. Rule-based and 
knowledge-based performance come into play only after one becomes consciously aware 
of a problem. In this sense, skill-based errors generally precede the detection of a 
problem and rule- and knowledge-based errors arise during subsequent attempts to find a 
solution. In regards to control modes, skill- and rule-based levels of performance are 


related to schematic modes of control, and knowledge-based levels of performance are 
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related to attentional-control-modes. The GEMS model attempts to present an integrated 
picture of the HE mechanism operating at all three levels of performance. A main 
assertion of GEMS is that when confronted with a problem, people are biased strongly to 
search for a familiar schema. This occurs at the rule-based level, before one attempts to 
solve the problem at the more demanding attentional knowledge-based level. This is true, 
even if the individual attempted to solve the problem at the knowledge-based level to start 
with (Reason, 1990). 

The GEMS model parallels closely the example of Rasmussen’s (1982) “skill, 
tule, knowledge’ based HE taxonomy. The difference is that Reason (1990) hypothesizes 
that an actor presented with a problem first attempts to solve the problem at the less 
attentionally demanding schema level. The actor in this situation attempts to use a 
familiar schema that has worked in the past to solve a similar problem. As an example, 
suppose that during aerial combat, the actor consistently relies on an effective high “g”’ 
manuever to disengage from an opponent. Then in the future if the actor finds himself in 
a position requiring a manuever of last resort to disengage from his opponent, he relies on 
the high “g’’ manuever prior to attempting anything else required to disengage from the 
aerial combat. 


6. The Helmreich Model 


The Helmreich Model approaches accident investigation into HE as a grouping of 
separate environments (Zotov & Dmitri, 1996). The intent of the model is to be a crew- 
centered study to accident causation and external factors are studied for their influence on 
the crew involved in the flight mishap. These separate environments are grouped into 
concentric circles, each affecting those they encircle. The theory of the model is that in 
reality the interaction and entanglement of multiple factors result in an accident (Zotov & 
Dmitri, 1996). 

The innermost circle, the crew environment, concerms issues regarding the crew’s 
interaction, communication, personalities and Crew Resource Management. 


Encompassing this circle is the physical environment in which the crew operates, issues, 
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such as aircraft idiosyncrasies, defects and performance characteristics, the weather, both 
local and general, and the airport environment. Outside of these factors is the 
organization that purchases and maintains the aircraft, trains the crews, and is supposed to 
support their actions. Surrounding these concentric circles is a regulatory environment in 
which regulatory action should ensure safe standards of operation (Zotov & Dmitn, 
1996). The Helmreich Model views the breakdown of human error in accidents as a web 
of entangled strands of HE, attaching causal factors at different points within the 
concentric circles. Frequently researchers debate whether an accident is the result of a 
chain of events. The Helmreich Model theorizes that the accumulation of factors, rather 
than a single linkage of chained events can cause an flight mishap. Accidents, seldom 
occuring in isolation, are more likely to happen as a complex web of events, culminating 
in the accident (Zotov & Dmitri, 1996). 

Looking at the previous examples, all the models have been centered on the actors 
and their actions or inaction. Helmreich brings into focus outside influences on the actor 
that influence what occurred in the flight mishap. As an example, consider an aviator 
involved in an FM where fatigue is the main causal factor cited in the flight mishap. To 
understand fully the main causal factor of the FM, the investigator must look outside of 
the aviator to the environment that effects him or her. Other factors just as important to 
the FM are: poor diet, weather, lack of proper supervision or proper leadership in the 
Organization. All these items may play an integral role in the FM, in addition to the 


aviator’s direct role in the flight mishap. 


Cc. HUMAN FACTORS ANALYSIS AND CLASSIFICATION SYSTEM 


The Naval Safety Center’s “HFACS” is a taxonomy developed specifically for 
NA (Shappel & Wiegmann, 1997). Influencing the HFACS taxonomy are many of the 
taxonomies discussed above. HFACS uses the theoretical basis for HE described by both 
Rasmussen and Reason in terms of skill-based, rule-based and knowledge-based levels of 
performance. As in Helmreich’s model, HFACS theorizes that accidents do not occur in 


isolation but are often the result of both internal and external influences like supervisory 
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and organizational HE contributing to the accident. This taxonomy also incorporates the 
“Domino Theory,” introduced by Heinrich (1980). MHeinrich’s theory proposed that 
accident causation is not singular but has many links in a chain to a tragic human error. 
Anywhere in this line of dominoes, someone could remove a causal domino to prevent 
that final, fatal domino from falling (Shappel & Wiegmann, 1997). Of course, as 
discussed by Helmreich, the solution may not be as simple as removing a single domino 
in the accident sequence to avert a flight mishap. Although the domino may be attached 
in the line of accident causation, a Strand in the web of causation could bypass this 
particular domino, and even though the domino is removed a continuity in the chain of 
events may still exist. In a human-factors-accident, research shows that complexity is the 
norm (Zotov & Dmitn, 1996). 

There are four identified layers of causation in the HFACS model: 

1) Organizational influences composed of latent failures, 

2) Unsafe supervision composed of latent failures, 

3) Preconditions for unsafe acts composed of active and latent failures, 

4) Unsafe acts composed of active failures (OPNAV 3750.6R). 
Active failures are those HEs the pilot has direct control over at the time the FM occurs, 
and latent failures are those causal factors the pilot has no direct control over at the time 
the FM occurrs. The HFACS taxonomy is illustrated by the “Swiss Cheese” model of HE 
causation, adapted from ideas of James Reason. The illustration is composed of four 
integrated overlapping layers that affect the final HE, which results in an accident (Figure 
1). The main point of HFACS is that HE is not studied as it is in the GEMS model. The 
GEMS model studies the operator level alone, but HFACS instead looks upward, as in 
the Helmreich Model, realizing that there may be multiple contributing factors to unsafe 


acts performed by the operator. 
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Figure 1. The “Swiss Cheese’ Model of HE Causation (adapted from Reason, 1990). 


Each of the overlapping layers as seen in Figure 1 is also composed of multiple 
underlying causal factors of human error. These underlying causal factors allow HE to be 
more specifically categorized. The structure of this taxonomy can be seen in Chapter III, 
Figure 2. The lowest categories in this taxonomy give a thorough breakdown of the 
majority of the prime contributors to a human error flight mishap. 

Part of the difficulty in analyzing and studying HE is developing a theory of 
human behavior and modeling it to human error (Park, 1994; Wickens, 1990; Senders & 
Moray, 1991). Analyzing and studying HE requires the development of a taxonomy 
using a solid theory of human performance. As described in the preceding sections, there 
are many taxonomies, developed by a diverse group of respected individuals, that 
describe HE in relation to human behavior. So where does the study of human error 
begin with so many HE taxonomies in the literature? To revamp or develop anew? is the 
question posed by Shappel and Wiegmann (1997). Researching the taxonomies from the 


viewpoint of the industry to be studied is the key. The answer for the U.S. Navy of 
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course is developing HFACS through a combination of the most relevant theories of HE 


to Naval Aviation. 


D. SUMMARY 


In spite of the academic differences in the study of human behavior, currently the 
mainstream view is to study behavior using the ideas of attentional and schematic control 
modes. The study of human behavior is essential in the development of taxonomy to 
study human error. From the understanding of behavior, taxonomies can be developed to 
chart the path and causes of HE in the operation of complex systems. Taxonomies of 
human error are a fundamental requirement to build a scientific foundation for the study 
of HE, and its causes (Hill, Byers, Rothblum & Booth, 1994). Such studies facilitate a 
more complete understanding of the nature, origin and causes of HE, all necessary for a 
clear classification scheme for describing human error. A taxonomies breakdown of the 
components of HE allows for the empirical study of human error. 

The need for a taxonomy with which to study Naval Aviation HEs is the impetus 


for the development of HFACS. As stated by Shappel and Wiegmann (1997): 


Once a comprehensive model is identified, a relational database needs to 
be constructed to assess the interrelations among error types. A relational 
database would facilitate the testing of theories about the strength of the 
relation between latent factors and the occurrence of specific errors 
committed by operators. Similarly, a relational database would allow for a 
more refined analysis of the effects that one type of operator error (e.g., 
judgment error) has on the occurrence of another (e.g., procedural error). 
In essence, once a unifying framework is identified, the causal chain of 
events leading to an accident can be more easily inferred, intervention 
Strategies more readily identified, and the tragic chain of events ultimately 
broken. (p. 79) 


The most appropriate solution is to develop anew. The method currently used by the U.S. 
Navy to investigate and classify HE is a scheme that is loosely tied to a “who? what? and 
why?” format (Shappel & Wiegmann, 1997). This format does not allow for the 


structured study of HE causation. To increase the effectiveness of combating HE, 
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HFACS was conceived, borrowing from some of the most well developed theories of 
human behavior and taxonomies of human error. HFACS was developed for the U.S. 
Naval Aviation community to classify and to assist in the reduction and prevention of 
human error. HFACS is the comprehensive model of HE and a natural relational 
database from which to study human error. Shappel and Wiegmann envisioned HFACS 
would assist in the reduction of Naval Aviation FMs due to human error. HFACS 
provides a relational database of HE for analysts to study using statistical tools, and 
HFACS serves as an excellent collection device for consistent data reporting of flight 
mishaps. For the Naval Aviation community, the more structured and empirical study of 
HE through HFACS offers insight into the causes of accidents due to human error. This 
empirically based study of HE will lead to active policies that reduce the occurrence of 


Naval Aviation human errors. 
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Ht, METHODOLOGY 


The ultimate goal in this thesis is to identify human errors (HE) common to many 
FMs, to increase pilot awareness of these identified HE types, and eventually to reduce 
the overall number of flight mishaps (FMs) citing these HE types. This study uses an 
existing database of Class A and B Tactical Aircraft (TACAIR) Mishap Investigation 
Reports (MIR) maintained by the Naval Safety Center (NSC). The MIRs selected are 
FMs citing HE as the primary causal factor of the accident. An analysis of the HE types 
in the data is conducted using the Human Factors Analysis and Classification System 
(HFACS) taxonomy’s breakdown of each flight mishap. Investigating the relationships 
between causal factors in the taxonomy will suggest where intervention strategies should 
be focused. In addition, by modeling FMs as Poisson Processes, the impact of these 
intervention Strategies is estimated. 

The analysis and impact of the intervention is complicated because HE types in 
the HFACS taxonomy share an involved dependence Structure. The HFACS taxonomy 
allows a single FM to be given multiple causal factors, the causal factors or HEs are not 
mutually exclusive. Given that there are 17 basic types of HE labeled I,..., Y (Figure 2) 
with a hierarchical structure, this yields a very complex conditional framework to the 
HFACS taxonomy. This complicates the dependencies between causal factors to a point 
where basic statistical analysis and modeling becomes extremely difficult and the use of 
simulation techniques in conducting the analysis is more promising in obtaining a 
working solution. Based on original flight mishap data and a Poisson arrival process for 
FMs, a simulation model is built to simulate future accidents and predict the HE 
characteristics of these accidents. From this simulation model, the ability to estimate the 
expected number of accidents for a specified number of flight hours and predict specific 


HE types involved in the FMs is possible. 
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A. NAVAL SAFETY CENTER DATABASE 


The NSC maintains a database, Safety Information Management System (SIMS), 
of all reported TACAIR flight mishaps. In 1998, Naval Aviation (NA) psychologists at 
the NSC took all human factors TACAIR Class A FMs from fiscal year (FY) 90 to FY98 
and classified them according to the HFACS taxonomy. This classification of the Class 
A TACAIR FMs by the NSC is used for the analysis. The database is also queried for all 
Class B human factors TACAIR FMs from FY90 to FY98 to be used in the analysis. The 
Class B TACAIR FMs are classified according to the HFACS taxonomy by the author, 
using the MIRs descriptions of causal factors in the TACAIR FMs. There are 122 Class 
A TACAIR FMs and 19 Class B TACAIR FMs, from FY90 to FY97 that were 
categorized as human factors flight mishaps (FM). For FY98, there are 12 Class A 
TACAIR FMs and zero Class B TACAIR FMs identified as human factors flight 
mishaps. The data for FY98 is set aside to validate the results of the simulation model, 
which is built using FY90 to FY97 data. 


B. MISHAP INVESTIGATION REPORTS (MIR) 


MIRs contain investigative data relating to the aircraft flight mishap. They are 
received by the NSC in the form of message traffic and written enclosures to the MIR and 
are entered into the SIMS database. They contain an extensive narrative of the flight 
mishap and supporting information of the FM pilot and FM aircraft, and identifiable 
contributing FM causal factors. The MIRs for all Class A flight mishaps are quite 
thorough and the quality of Class B MIRs vary depending on the severity of the FM, the 
greater the damage the more thorough the investigation. Since the quality of Class B 


MIRs varied, only those FMs that were thoroughly investigated are included in the study. 


Cc. FLIGHT MISHAP CLASSIFICATION 


The Class A and B FMs that are classified according to the HFACS taxonomy are 
entered into a Microsoft Excel 97 spreadsheet. This creates 25 columns of binary 


variables, one for each type of HE (Figure 2). A “1” indicates the HE type is present in 
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that FM, “0” otherwise. This puts the data in a matrix that will allow an exploratory 
analysis to be conducted on the data using statistical computing tools, such as S-Plus®. 
The columns of the spreadsheet consist of categorical data including date of occurrence, 
aircraft type and a listing of all HFACS causal factors. Each row of the spreadsheet 
corresponds to individual FMs. For ease in coding, instead of using the HE 
nomenclature, the columns are identified using a single letter for each type of HE (Figure 


a): 
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Figure 2. HFACS taxonomy: text next to the causal factor codes the factors A,..., Y and 
gives the number of FMs the factor is associated with. For example, A/141 codes Unsafe 
Acts as “A” and in 141 FMs Unsafe Acts were cited as a causal factor. 


D. OVERVIEW OF ANALYSIS 


Grouping HE types into levels using the hierarchical structure of the HFACS 
taxonomy in Figure 2 facilitates the analysis of the NA Class A and B FMs studied. 
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There are three basic levels in Figure 2 of the HFACS taxonomy. They are categorized in 
a hierarchical relationship with the lower levels being subsets of HE types contained in 
the higher levels. The lowest level is defined by the HE types coded I,..,Y in Figure 2 and 
these compose the nuclei of the HFACS taxonomy. All HE types in higher levels are 
composed of groupings of lower level HE types. The middle level is defined by the HE 
types coded E, F, G, H, C, and D in Figure 2. HE types A, B, C, and D in Figure 2 define 
the highest level in Figure 2. As an example of the hierarchical nature of the sets, the 
middle level HE type E is made up of all FMs that cited either HE type I, J, or K. 
Through a visual analysis of Figure 2, this hierarchical relationship discussed between HE 
types is readily apparent. 

Statistical analysis is conducted separately for each level of the HFACS hierarchy 
to identify relevant causal factors and predictive patterns found in the data. The lowest 
level of the HFACS taxonomy will receive the majority of the analysis since the HE types 
contained in this level define all other levels. The correlation between the occurrence of 
causal factors in FMs for each level is evaluated to determine any important pairwise 
relationships. A cluster analysis is performed to identify important groupings of multiple 
HE types within each level using the function Mona in S-Plus©. A matrix of subset 
relationships is developed to identify important interrelations between the HE types in 
each level. To determine the validity of assuming a Poisson arrival process for FMs, a log 
linear model of the Class A and B FM occurrences is constructed using flight hour and 
accident data from FY90 to FY97 for Naval Aviation TACAIR. 

A simulation model is developed in light of the complicated dependencies among 
HE types in FMs using S-Plus©. This simulation is a form of bootstrapping (see Davison 
& Hinkley, 1997) that sheds light on the results that classical statistics cannot. First, the 
simulation model generates FMs based upon a Poisson Process with arrival rate estimated 
from historical data. For each FM, the HE types are then generated. These are modeled 
directly using the empirical distribution of the historical HE type combinations. This 
distribution is composed of all Class A and B TACAIR FMs from FY90 to FY97 and is 


seen as fair representation of the distribution of HE types found in Naval Aviation 
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TACAIR flight mishaps. Potential intervention strategies are identified based on the 


simulation results and are compared to FY98 flight mishaps. 
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IV. RESULTS 


The purpose of the data analysis is to determine important relationships between 
the 25 causal factors in the Human Factors Analysis and Classification System (HFACS) 
taxonomy (A — Y of Figure 2) and verify that the accident arrivals for the Class A and B 
Tactical Aircraft (TACAIR) Human Error (HE) Flight Mishaps (FMs) can be modeled as 
a Poisson Process. The data used for the analysis are the 141 Class A and B TACAIR 
FMs between fiscal year (FY) 90 and FY97 that cited HE as the primary causal factor 
(FMs due entirely to mechanical or maintenance human factors were excluded). The 


TACAIR FMs for FY98 are set aside to validate the flight mishap (FM) rate of the model. 


A. DATA ANALYSIS OF CAUSAL FACTORS 


Classifying the 141 FMs according to the HFACS taxonomy (Figure 2) gives a 
binary row vector of 1’s and 0’s for each flight mishap. A “1” indicates that causal factor 
is cited in the FM, a “O” indicates that causal factor is not cited in the flight mishap. 
Combining these vectors gives a 141x25 binary asymmetric matrix X with FMs defining 
the rows and the HE types defining the columns. In addition, we define sets for analysis 
corresponding to each causal factor to be subsets of FMs that cited that causal factor 
(Table 1). Exploration of the data is undertaken by analyzing the relationship between 


these sets. 
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ike Notation and Structure Data 


For initial data exploration, the HE types correspond to sets of FMs that exhibit 


that HE as defined in Table 1. The relationships between the sets are defined as: 


(eOR UCUDI=XxX, @0) 
(E UF) =A, (2) 
(Ge rH) — se. (3) 
SOrToUuy=c, (4) 
WUxXUT)I=D, (5) 
IUJUK)=E, (6) 
(Lv) — i. (7) 
(NWO UP)=G, (8) 
(QUR) =H. (9) 


Note that sets on the left-hand side of equations (1) to (9) are not necessarily mutually 
exclusive. There is a hierarchical relationship between these sets as shown in set 
equations (1) to (9) and visually in Figure 2. This relationship is used to infer findings in 
the lowest level to higher level HE types, which is important because it allows the study 
to focus on the most basic HE types. The corresponding HE types at the bottom of the 
HFACS in Figure 2 are exhaustive in their classification of error. They are considered 
subsets of the HE types defined in the higher levels. For example, see equation (9), HE 
type E (Error) contains all FMs that cited either HE type I (Skill-Based Error), J (Decision 
Error) or K (Perceptual Error) or any combination of the three. 

Three classes of sets are constructed using this subset relationship. Each class 
represents a level of classification in the HFACS hierarchy. The first class HFACSA is 
built from the top level (Figure 2), sets A, B, C and D (Table 1), the second class 
HFACSB is built from the middle level (Figure 2), sets E, F, G, H, C and D (Table 1), 
and the third class HFACSC is built from the bottom level (Figure 2), sets I,...,Y (Table 
1). Appendix E contains a key for HE types coding. 
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Table 1. Set definitions for HFACS sets A...Y and the Universal set XX. Example: set A 
contains all FMs that identified A as a causal factor. 


Set Definitions: 


XX 


se GES rod Oo 4 EA SO ami Ow > 


{all TACAIR human factors Class A & B FMs from FY90 to FY97, excluding 
excluding those FMs attributable to mechanical or maintenance human factors} 
{xx | xx cited as a causal factor Unsafe Acts} 

{xx | xx cited as a causal factor Preconditions for Unsafe Acts} 

{xx | xx cited as a causal factor Unsafe Supervision} 

{xx | xx cited as a causal factor Organizational Influences} 

{xx | xx cited as a causal factor Errors} 

{xx | xx cited as a causal factor Violations} 

{xx | xx cited as a causal factor Substandard Conditions of Operators} 
{xx | xx cited as a causal factor Substandard Practices of Operators } 
{xx | xx cited as a causal factor Skill-Based Errors} 

{xx | xx cited as a causal factor Decision Errors} 

{xx | xx cited as a causal factor Perceptual Errors} 

{xx | xx cited as a causal factor Infraction} 

{xx | xx cited as a causal factor Exceptional} 

{xx | xx cited as a causal factor Adverse Physiological State} 

{xx | xx cited as a causal factor Adverse Mental State} 

{xx | xx cited as a causal factor Physical/Mental Limitation} 

{xx | xx cited as a causal factor Crew Resource Management (CRM)} 
{xx | xx cited as a causal factor Personal Readiness} 

{xx | xx cited as a causal factor Inadequate Supervision} 

{xx | xx cited as a causal factor Planned Inappropriate Operations} 
{xx | xx cited as a causal factor Failed to Correct Problem} 

{xx | xx cited as a causal factor Supervisory Violation} 

{xx | xx cited as a causal factor Resource Management} 

{xx | xx cited as a causal factor Organizational Climate} 

{xx | xx cited as a causal factor Organizational Process} 


Another way to look at these classes is by identifying them with the matrix X 
defined at the beginning of Chapter IV. X is a 141x25 matrix with all HFACS HE types 
defining the columns and all 141 FMs between FY90 and FY97 defining the rows. The 


first class corresponds to the four columns of X, which are indicators for sets A, B, C and 


D. Extracting these four columns from X gives a 141x4 matrix that is equivalent to the 


first class; these four column vectors define the matrix X4. The second class corresponds 


to column vectors E, F, G, H, C and D of X. Extracting these six columns from X gives a 


141x6 matrix that is equivalent to the second class; these six column vectors define the 


matrix Xp, The third set corresponds to column vectors I,...,Y of X. Extracting these 17 
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columns from X gives a 141x17 matrix that is equivalent to the third class; these 17 
column vectors define the matrix Xc, All FMs contained in classes HEFACSA, HFACSB 
and HFACSC are also contained in their respective matrices Xa, Xp and Xc along with the 
corresponding FM causal factors. Looking at the classes and the matrices one should 
again note that none of the sets is mutually exclusive, a single FM may belong to many 
different sets. For this reason, there are multiple dependent relationships among the HE 
types. Analysis using the simple probability of a HE types occurrence cannot be used in 
the exploration of relationships in the HFACS taxonomy. 


Ze Analysis of Pairwise Dependency 


To take an initial look at the relationship between HE types, correlation matrices 
are Calculated for the columns of X,, Xp and Xc (Appendix A). The highest correlation 
for all three matrices is in Xc between set N (Adverse Physiological State) and K 
(Perceptual Errors) with a correlation of .623. After this, the highest correlation is .409 
between sets U (Failed to Correct Problem) and V (Supervisory Violation) in the matnx 
Xc. All correlations otherwise range between -.287 and .344 for all three matrices. The 
accident data is examined and the relationship between N and K is found to have a mild 
positive relationship. In addition, U and V are found to have an even milder positive 
relationship. The correlation between N and K addresses 23 FMs (Table 2), and the 
correlation between U and V only addresses 4 flight mishaps. The fact that the only 
potentially important relationships in the correlations are found in Xc is not surprising 
given the hierarchical nature of the HFACS taxonomy. Since the upper levels of the 
HFACS taxonomy are defined by lower level sets, the correlations are diminished in 
significance as one proceeds up the classifications in the taxonomy. 

From this point on, this analysis will concentrate on the class HFACSC. The 
reason for concentrating on HFACSC is that the HE types defining this class are the most 
substantive HE types. They are an exhaustive listing of HE types that are used to define 
the sets in the higher classes of the HFACS taxonomy. The intent of further study is to 


concentrate on the more specific HE types of HFACSC. This can be done without loss of 
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generality since all sets in the class HFACSC are subsets of sets in both classes HFACSB 
and HFACSA as defined in set equations (1) — (9). 

To look more closely at HFACSC, we first compute a matrix that defines the 
number of FMs that cite a specific HE type and the combinations of HE types (Table 2), 

Mc =(Xc)' (Xo). (10) 
The rows and columns of Mc are indexed by i,j =[L...,Y, let each m,(i,j) be the number 
of FMs in the intersection of sets i and j. Then m,(i,i) defines the number of FMs 
contained in seti. As an example, m,(N,K) = 23, is the number of FMs in the intersection 
of sets N and K, so 23 FMs between FY90 and FY97 cited both HE type N and K as 
causal factors in the FM. 

To calculate the proportions, FMs in pairwise intersections of HEs, let Pc be the 
proportion matrix, 

Pc =m,(1,))/141 Vind (11) 
where 141 is the total number of FMs in FY90 to FY98. The diagonal of this matrix 
gives P( i ), the proportion of total FMs citing HE type “1” to the total number of FMs 
studied (Table 3). All other cells give P (i - j), the proportion of total FMs citing HE 
type “i” and “j” in combination to the total number of FMs studied (Table 3). A notable 
observation in the analysis is that proportion Pc(i,i) or the proportion of FMs with HE i is 
not the sum of Pc(i,j) for all j, because of the non-mutually exclusive character of 


HFACS. 


on 


Table 2. Matrix Mc (Intersection of Sets). Example, at cell m,(I,J), the intersection of 
sets I and J indicates that 38 of 141 FMs between FY90 and FY97 shared the causal 
factor combination of J and J. At cell m.(I,J) there are 87 FMs indicating that HE type I 
was cited as a causal factor in 87 of 141 FMs between FY90 and FY97. 
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Table 3. The proportion matrix Pc, the diagonal of this matrix gives the P (1 ) and all 
other cells give the P (1 1 j) for alli and j. 


I J K iL M N O P Q R S T U Vv Ww Xx x 
0.62 0.27 0.11 0.10 0.04 0.13 046 0.04 0.31 0.03 0.13 0.06 0.04 0.06 0.17 0.01 0.18 
0.53 0.09 0.11 0.08 0.08 0.36 0.01 032 0.02 0.14 0.09 0.04 0.05 0.13 0.00 0.19 
0.257 0.09 0.05 0.16 0.20 0.0] O11 0.03 0.06 002 002 0.01 0.06 O01 500s 

0.21 0.04 0.06 0.12 0.01 0.09 0.01 0.05 0.01 0.03 0.02 0.04 0.01 0.05 

0.13 0.04 0.06 0.01 0.06 0.01 0.01 0.01 0.01 0.00 0.02 0.01 0.01 

0.21 0.18 0.01 0.09 0.02 0.05 0.01 0.02 0.01 0.06 0.01 0.06 

0.68 0.05 0.35 0.04 0.16 0.10 0.06 0.06 0.19 0.01 0.21 

0.06 0.04 0.01 0.01 0.00 0.01 0.01 0.02 0.00 0.01 

0.49 0.01 0.11 0.05 0.03 0.04 0.10 0.01 0.14 

0.05 0.03 0.01 0.01 0.01 0.00 0.00 0.01 

0.23 0.06 0.02 0.04 0.06 0.00 0.09 

0.11 0.00 0.01 0.03 0.00 0.04 

0.06 0.03 0.02 0.01 0.01 

0.07 0.03 0.00 0.02 

0.26 0.00 0.11 

0.01 0.00 

0.30 
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An important part of this analysis is looking at the conditional proportions of FMs 
in the intersection of HE sets. To determine these conditional proportions, let Sc be the 
matnx, 

Sc =m-(i,j)/m-(ii) Vii. (12) 
The entries of Sc give the proportion of FMs citing a specific causal factor given that FM 
also cites another causal factor (Table 4). For example, at cell (O, T), (read column to 
row) (.88 x 100) percent of the time given an FM cites HE type T (Planned Inappropriate 
Operations) as a causal factor, that FM will also cite HE type O (Adverse Mental State) as 
a causal factor. 


Table 4. The subset matrix Sc. Example, at cell (O, T), (in order to read the relationship 
correctly, read the column causal factor first. Then read the row causal factor in the 
following statement) when HE type T is cited in an accident, (.88 x 100) percent of the 
time HE type O is also cited in that mishap. 


I J K L M N O P Q R S i U Vv W Xx x 

0.51 0.46 0.48 0.26 0.60 0.68 0.75 0.64 057 058 056 90.75 0.90 0.65 1.00 0.58 
0.44 0.34 055 058 0.37 0.53 0.13 0.65 0.43 0.61 0.75 0.75 0.70 0.49 0.00 0.63 
0.18 0.16 0.41 0.37 0.77 0.29 0.25 0.22 057 0.24 0.19 0.38 0.20 0.24 1.00 0.16 
0.16 0.21 0.34 0.26 0.30 0.18 0.13 0.17 0.29 0.21 0.06 050 030 0.14 1.00 0.16 
O0650.15 0.2040.17 0.17 0:09 0:25 0.13 .0.29 0:06 0.13 0:13 0:00 0:03 “1.05005 
0.21 0.15 0.66 0.31 0.26 0.26 0.25 0.17 0.43 0.21 0.13 038 0.20 0.24 1.00 0.19 
0.75 0.68 0.80 0.59 0.47 0.83 0.88 0.71 0.86 0.70 0.88 1.00 0.90 0.73 1.00 0.70 
0.07 0.01 0.06 0.03 0.11 0.07 0.07 0.07 0.14 0.03 0.00 0.13 0.10 0.08 0.00 0.05 
0.51 0.60 0.43 0.41 0.47 0.40 0.51 0.63 0.29 045 0.44 050 050 0.38 1.00 0.47 
0.05 0.04 0.11 0.07 0.11 0.10 0.06 0.13 0.03 0.12 0.06 0.13 0.10 0.00 0.00 0.05 
022027 0:23 0.24 0.11 0:23 0.24 0.13 0.22 057 0.50 0.38 0.50 0.22 0.00 0.28 
0.10 0.16 0.09 0.03 0.11 0.07 0.15 0.00 0.10 0.14 0.24 0.00 0.10 0.11 0.00 0.14 
0.07 0.08 0.09 0.14 0.05 0.10 0.08 0.13 0.06 0.14 0.09 0.00 0.40 0.08 1.00 0.05 
0.10 0.09 0.06 0.10 0.00 0.07 0.09 0.13 0.07 0.14 0.15 0.06 0.50 0.11 0.00 0.07 
0.28 0.24 0.26 0.17 0.16 0.30 0.28 0.38 0.20 0.00 0.24 0.25 0.38 0.40 0.00 0.35 
0.01 0.00 0.03 0.03 0.05 0.03 0.01 0.00 0.01 0.00 0.00 0.00 0.13 0.00 0.00 0.00 
0.29 0.36 0.20 0.24 0.11 0.27 0.31 0.25 0.29 0.29 036 038 0.25 030 0.41 0.00 
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For purposes of identifying important conditional proportions in the matrix in 
Table 4, a floor of (.70x100) percent is set for that case to be considered in further 
analysis. There are 19 such sets which meet the 70 percent floor in Table 4 (entries in the 
X column are not considered since they represent only one FM and do not provide any 


insight into other flight mishaps). These sets are listed in Table 5. The most important 
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combinations contain HE type O (Adverse Mental State) the largest proportion of the 
time, 12 of 19 times in Table 5. The most important combinations after these are I (Skill- 
Based Error) 3 of 19 and J (Decision Error) 3 of 19. Clearly, Adverse Mental State stands 
Out as a consequential factor in Table 4. 

To explore these stronger relationships found in the analysis and listed in Table 5, 
a simulation model is constructed to predict the character and occurrence of future HE in 
Naval Aviation TACAIR Class A and B flight mishaps. By using historical FM data, we 
can simulate the conditional proportion of HE types and then construct confidence 
intervals (CIs) based on the simulated occurrence of the HE types, to determine their 


statistical significance. 


Table 5. Important Subsets in Table 4. For example: P c O, 87.5 percent of all 
accidents citing causal factor P also cited causal factor O. 
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3. Cluster Analysis 


Cluster analysis of the data is accomplished using a monothetic clustering method 
for analysis of matrices with asymmetric binary variables (Kaufman & Rousseeuw, 
1990). This method takes advantage of the binary asymmetric structure of the HFACS 
matrices. The method clusters the data according to its combination of 1’s and 0’s. This 
method is applied to all three sets using the function mona in S-Plus® with the following 
results: 

1) HFACSA with four sets has 2* combinations and it clustered into eight 

separate combinations. 

2) HFACSB with six sets has 2° combinations and it clustered into 32 separate 

combinations. 

3) HFACSC with 17 sets has 2'’ combinations and it clustered into 121 separate 

combinations. 

The 121 combinations used by Mona to cluster HFACSC covered 141 accidents, 13 
combinations shared multiple accidents, while 108 accidents are unique combinations 
(see Table 6 for listing of multiple accidents sharing the same causal factor 
combinations). 

Within the cluster analysis of all 141 accidents, certain combinations appear 
dominant, as can be partially seen in Table 6 and are fully listed in Table 7 for the 121 
separate combinations found in the cluster analysis. It can be seen that O (Adverse 
Mental State) and Q (CRM) appear in combination with other causal factors a large 
proportion of the time. Of the 17 causal factors, there are four factors which reoccur 
repeatedly in all accident combinations, these are O (Adverse Mental State), Q (Crew 
Resource Management (CRM)), I (Skill-Based Errors), and J (Decision Errors). This 
pattern can also be seen in an analysis of pairwise dependency in the sets, where O 
(Adverse Mental State) was identified as the most important factor in the analysis. It can 
be seen in Table 7 that Adverse Mental State is also contained in 6 of the 9 important 


combinations identified in the cluster analysis. This agreement in each analysis as to the 


4] 


importance of Adverse Mental State highlights the significance of HE type O (Adverse 
Mental State) in Naval Aviauon TACAIR flight mishaps. 


Table 6. Combinations of causal factors which are common to more than one accident. 
Example, three accidents share the same causal factor combination of I and Q. 
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Table 7. Percent of accidents having the specific causal factor combinations. Example, 
for the combination O & J (Adverse Mental State and Decision Error) 50 percent of all 
accidents studied had both of these listed as causal factors in the accident. 





B. ANALYSIS OF ACCIDENT ARRIVAL RATES 


A general log linear regression model that hypothesizes a Poisson distribution 
with rate proportional to flight hours supports the assumption that the accident arrival rate 
follows a Poisson Process. Data used to construct the log linear regression model are 


flight hours for Naval TACAIR for FY90 to FY97 and the number of Class A and B 


TACAIR FMs for FY90 — FY97 (Table 8). The regression model uses the expected value 
of a Poisson arrival process to test the hypothesis that the data is from a Poisson 
distribution with, 

E(TACAIR FMs) = At, (is) 
where A is the accident arrival rate/100,000 flight hours and t is flight hours per 


year/100,000. Taking the natural log (In) of both sides yields a log linear equation for 


regression, 

InfE(TACAIR FMs)] = In(A) + In(t). (14) 
Restating equation (14) using regression coefficients and variables, gives the following 
equation: 

InfE(TACAIR FMs)] = Bo+ Bix1, (15) 


where Bo = In(A), B; is the regression coefficient for x; and x; = In(t). 

If equation (15) is considered representative of a Poisson process, then B; must 
equal one. To test the hypothesis, Ho: B; = 1, the data in Table 8 is fit to a log linear 
model (equation (15)). Using S-Plus© to calculate the coefficients and variables of the 
log linear regression model, a 95 percent confidence interval (CI) of (.6527, 3.014) is 
found for B;. Since 1 is contained in the 95 percent CI, at an & = .05, the hypothesis that 
B, = 1 cannot be rejected and the distribution is assumed to be Poisson with the rate 


proportional to flight hours. 


Table 8. Flight Hours and Human Factors Class A and B TACAIR FMs FY90 to FY98. 
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c. SIMULATION 


The simulation is built using S-Plus© (see Appendix C for simulation code) with 
two principle assumptions: 

1) That accident arrivals can be modeled using a Poisson Process. 

2) All HE types for future FMs can be modeled from the 121 distinct accident 

combinations found in the Monothetic cluster analysis (Mona). 

To run a simulation, the average accident arrival rate from FY90 to FY97 is used 
along with FY98 flight hours/100,000 (Table 8) to generate accidents from a Poisson 
distribution, where the average accident arrival rate is assumed to be the sum of the flight 
hours/100,000 from FY90 to FY97 divided by the sum of the Class A and B TACAIR 
FMs from FY90 to FY97 (Figure 3). Each iteration generates an observation from the 
Poisson distribution; this sets the number of accidents for that simulated period. In a 
simulation there are 1000 iterations, each iteration representing one time period with its 
own specific number of flight mishaps. 

The characteristics of individual accidents for each period are determined by a 
uniform random selection between | and 141 (the total number of TACAIR Class A and 
B FMs FY90 — FY97), the FM characteristics based on the 141 historical HE types found 
in FY90 to FY97 flight mishaps. This is equivalent to a nonparametric sampling 
bootstrap with replacement from the empirical distribution of historical FM 
characteristics. This allows for formal inference. 

Based on the Naval Aviation TACAIR Class A and B FM rate from FY90 to 
FY97, the accident arrival rate is 3.21 FMs/100,000 flight hours. Using the Class A and 
B TACAIR flight mishap rate, the simulation model can be validated with FY98 flight 
hours. To compute the distribution of FMs predicted for FY98, use the accident arrival 
rate for FY90 to FY97 and the flight hours flown in FY98 and run it through two 


thousand iterations in the simulation model. Using 408,500 flight hours flown for FY98, 


the results of the simulation are an expected value of 13 FMs in FY98, the actual accident 


rate for FY98 is 12 flight mishaps. 


Accidents and Accident Rate FY90 - FY98 


Rate O Accidents 
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Figure 3. Class A and B TACAIR average accident arrival rate/100,000 flight hours from 
Fy 90 10 FY 98. 


The frequency of important HE types, found to be important both singularly and 
in combination (Table 5) in earlier analysis, is calculated for the simulation run. 
Important singular HE types are considered from earlier analysis to be Adverse Mental 
State, Skill Based Errors, Decision Errors, Crew Resource Management and 
Organizational Process, each of these has a proportion of occurrence greater than .30 
(Table 4). 

For the simulation run of 1000 iterations, Figure 4 displays the histogram of the 
accident arrival rate. The mean and 95 percent CIs for each HE type both individually 
and in combination (Table 5) are computed and listed in Appendix B. For a HE type 
either individually or in combination (Table 5) to be considered significant, it is 
hypothesized that at a = .05 the expected number of FMs predicted is greater than 0. All 
single HE types that are considered important and run in the simulation are found to be 
significant at @ = .05. For the important combinations in Table 5 only I (Skill-Based 
Error) — O (Adverse Mental State) and Q (CRM) — O (Adverse Mental State) are 


significant at a = .05. 
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Figure 4. Histogram of 1000 iterations of simulation, showing the wide variance of the 
number of accidents yielded by the Poisson arrival rate for Class A and B TACAIR FMs. 
The results in the simulation support the importance of the HE type O (Adverse 
Mental State), exhibited in both the cluster analysis and the pairwise dependency analysis. 
The most substantial support from the simulation is found in the pairwise combinations, 
where Adverse Mental State is in 2 of 2 combinations, the only significant combinations 
that are found in the simulation. Adverse Mental State is significant in all three separate 
types of analysis, emphasizing the importance of Adverse Mental State in TACAIR 
human error flight mishaps between FY90 and FY97. Notably, there are no other HE 


types that influenced the analysis as strongly as Adverse Mental State. 
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Ni SUMMARY, DISCUSSION AND RECOMMENDATIONS 


A. SUMMARY 


The study of human error (HE) in Naval Aviation (NA) flight mishaps (FM) does 
not often present a clear path to a single primary causal factor. Accidents, which occur 
primarily due to HE, are often composed of a web of intertwined factors that contribute to 
the accident. The recently developed Naval Safety Center (NSC) Human Factors 
Analysis and Classification System (HFACS) assists in explicating the picture. Through 
research and studies, Naval Aviation psychologists at the NSC have taken approximately 
289 HE classifications (Shappel & Wiegmann, 1994) and clustered them into 25 basic 
distinct HE types (Figure 2). Each of these 25 separate categories is a node on this web 
of intertwined causal factors. These nodes are composed of multiple types of human 
failures grouped together because of their similarities. Within each of these nodes is a 
web of its own which may appear clear and symmetric for analysis of any particular FM 
or may be tangled and chaotic in the analysis of the flight mishap. 

Whether a FM is clear or tangled, the power in the HFACS taxonomy is that it 
allows the researcher to classify many single HEs into specific groupings, allowing for a 
focused analysis. For example, Adverse Mental State in the HFACS taxonomy is 
composed of approximately ten individual types of human error. These individual types 
of HE are grouped under a common idea, the pilot is not mentally prepared for the flight 
and this adversely affects the pilot’s performance. Breaking the taxonomy into 25 basic 
HE categories allows the researcher to concentrate on specific general types of HE. 
Instead of having to study 289 separate types of HE, the researcher can focus on 25 
clusters of general HE causation. This clustering of HE by HFACS and its foundation in 
widely accepted theories of HE allows a well-structured analysis of human factors flight 


mishaps. 
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In this analysis of 141 Class A and B TACAIR human factors FMs, the design of 
the HFACS taxonomy allows one to focus on specific intervention strategies. The key to 
the analysis is the subset relationships, equations (1) to (9). The 289 types of HE are 
clustered in 17 categories of general HE types, the bottom row of Figure 2. To analyze 
the relationships between these 17 sets IJ, ...,Y (Table 1), the matrix of subsets is studied 
(Table 4). This matrix presents an important relationship in Adverse Mental State (Table 
3), for 12 of the 17 HE sets primarily contained in Adverse Mental State. The next 
closest relationship looking at subsets is Skill Based Error and Decision Error, each of 
these substantially encompassed three HE sets. All other relationships within the subset 
matrix showed no important patterns. 

The important pattern seen in the relationships between Adverse Mental State and 
the 12 other causal factors definitely stands out among all other relationships considered. 
Nowhere else in the data is such an important relationship found. So the questions arise, 
do we need to look at causal factors having important relationships with other causal 
factors, or should we concentrate on the most frequently occurring singular causal 
factors? According to some theorists, all that is required to prevent an accident is 
intervention at a single level or causal factor and the FM could be prevented. This may 
be a Start to prevention but some would consider this theory a bit simplistic (Zotov, 
1996). 

An FM is composed of many HEs, and even though these single HEs are clustered 
into common categories of error, there is a great deal of entanglement between categories. 
It is constructive to picture the HE entanglement as a circular web of dominos connected 
by multiple strands of a spider’s web. If one causal factor to a flight mishap is removed, 
there is no guarantee that the chain of events leading to the FM has been severed. Just as 
in a spider’s web, removing one segment of the web doesn’t guarantee that the web has 
been destroyed. The study of HE is not an exact science, and it is often clouded by many 
variables in its study. For this reason, the focus cannot be singular, but one must try to 
encompass as many factors as possible. In attempting to reduce the FM rate, the focus 


cannot be on a singular cause that seems to stand alone in the analysis. The focus needs 


48 


to be on an HE type that appears to be an important member of this total FM web (Figure 
5); 
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Figure 5. Web of Important Relationships Surrounding Adverse Mental State. 


The important factor for this study in the FM web is Adverse Mental State, as 
stated previously, 12 of the 17 bottom HE types in the HFACS taxonomy have important 
subset relationships within Adverse Mental State. These 12 important factors are: Skill- 
Based Errors, Perceptual Errors, Adverse Physiological State, Physical/Mental 
Limitations, Crew Resource Management, Personal Readiness, Inadequate Supervision, 
Planned Inappropriate Operations, Failed to Correct Problem, Supervisory Violations, 
Resource Management, and Organizational Process. As seen in Figure 5, these HE types 
create an FM web, where Adverse Mental State connects to each factor in an important 
way. If intervention at the point of Adverse Mental Error were attempted, this 


intervention would affect many other possible causal factors in a potential FM. Listed in 


49 


Appendix F is a detailed description of the HFACS taxonomy, and it describes the 12 


general types of HE categories attached to Adverse Mental State (Figure 5). 


B. DISCUSSION 


In a recent message released by the NSC (Aviation Safety Monthly Summary for 
Feb. 99), the NSC highlighted NA’s current progress in reducing HE. The message 
looked at Class A FMs for all NA aircraft between fiscal years (FY) 90 and FY98, a total 
of 212 FMs. Analyzing the findings of the NSC’s message gives a comparison with this 
current study of Naval TACAIR Class A and B FMs from FY90 to FY97. This gives a 
comparison of how the TACAIR community is doing compared with the NSC’s 
impression of the NA fleet as a whole. To recap the thesis, it covered all Naval TACAIR 
Class A and B FMs from FY90 to FY97, and FY98 is used to validate the simulation 
model used in the study. Of the total 212 Class A FMs evaluated in the NSC’s message, 
this thesis looks at 134 of these FMs (63 percent) and an additional 19 Class B FMs are 
included for FY90 to FY98. 

The following discussion contrasts the three main points presented in the NSC 
message with the findings of this thesis. To begin, let us first review the NSC’s points: 

1) For all Class A Naval Aircraft FMs from FY90 to FY98 a downward trend in 

the FM rate exists. 

2) A Strong correlation between leadership and the reduction of violations 

exists. 

3) In FY98, “Skill-Based Errors” emerged unchecked and the current trend 

shows that this type of HE will be involved in an excess of 65 percent of future 

FMs. 
The above statements regarding Naval Aviation. in general from FY90 to FY98 are 
insightful points of contrast to compare this analysis of Naval Aviation TACAIR. Take 
the first point concerning the downward trend in Naval Aviation’s FM rate from FY90 to 
FY98. An initial observation of the TACAIR data and NA in general is that discerning a 


downward trend in the Naval Aviation FM rate is difficult. The reason for this 1s that the 
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accident arrival rate is assumed to be best modeled by a Poisson arrival process, and it is 
difficult to determine a trend when moving from one year to the next. This is especially 
true when the arrival rate does not deviate far from the mean of the assumed distribution. 

In a Poisson arrival process, the number of FMs are expected to fluctuate above 
and below the mean, so care must be taken when trying to identify trends. We must be 
careful when stating that a downward trend exists because of the randomness found in the 
occurrence of human error. The actual FY98 FM rate for Naval TACAIR is one accident 
below the expected eight-year average arrival rate of the simulation run. Therefore, it 
cannot be concluded that there has been a Statistically significant change in the true flight 
mishap rate (Figure 4). Looking at the data for FY90 to FY98, neither can it be 
concluded that there is a downward trend in the FM rate for the Naval TACAIR 
community during this period. 

The second issue to contrast is the reduction in violations due to better leadership 
and supervision in the NA community. Looking at the Naval TACAIR community’s 
human error FMs from FY90 to FY97, refer to the correlation matrices (Appendix C) to 
find that the correlation between Unsafe Supervision (C) and Violations (F) is —0.076. 
This correlation suggests that in Naval TACAIR there is no positive relationship between 
the findings of “Unsafe Supervision and Violations” in the TACAIR human factors FMs 
studied. If “Unsafe Supervision” is cited in an accident, then the chance that “Violation” 
is cited in the accident does not increase and vice versa. Therefore, during the period 
FY90 to FY97, there was no significant positive relationship between “Unsafe 
Supervision and Violations” in the Naval TACAIR community. Any finding regarding 
this relationship during the period FY90 to FY97 would have to be drawn from sources 
other than the HFACS categorization of HE that are based on the MIRs. 

The third point to contrast is the rise of “Skill-Based Error” in NA. To look at 
this problem in Naval TACAIR, a spreadsheet is constructed with the following 
attributes: 25 columns each containing a causal factor in the HFACS taxonomy and 9 
rows for FY90 to FY98. The data for FY98 is sparse because not all FMs have been 


closed out and released for analysis. Each cell contains the total number of accidents that 
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cited a specific causal factor for that fiscal year. The cells were then divided by the total 
TACAIR flight hours for that fiscal year and multiplied by 100,000 (Appendix D). This 
allows all cells to be compared on the same scale, the number of causal factors/100,000 
flight hours. Upon inspecting the “Skill-Based Error’ rates from FY90 to FY98, no 
important fluctuations are found. Looking at Figure 6, a histogram of the FY98 
simulation run results for “Skill-Based Error,” if all twelve accidents considered in this 
study for FY98 should cite “Skill-Based Error” as a causal factor in the FM. Nothing can 
be concluded about this event being statistically significant because the twelve accidents 
are contained in the 95 percent CI for the “Skill-Based Error’ distribution, calculated 


using the simulation. 
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Figure 6. Poisson distribution of “Skill-Based Errors”, based on 408,500 flight hours, 
using simulation model n=141. 
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Co RECOMMENDATIONS 


The Naval TACAIR communities flight mishap rate has remained fairly constant 
from FY90 to FY97 and given the assumption of a Poisson arrival rate for FMs, the FY98 
FM rate has been well modeled. The actual accident rate in FY98 is 12 TACAIR flight 
mishaps that are attributable to HE and the model predicts 13 FMs due to HE for FY98. 
The models 95 percent confidence interval (CI) for the FY98 expected accident rate is 
(6,21), the actual FM rate of 12 is well contained in the 95 percent CI. The conclusion 
from the model’s result is that there has been no significant change in Naval TACAIR’s 
human factors FM rate in FY98 when compared to the long-term FM rate from FY90 to 
evo. 

Looking at the results from the simulation (Appendix B), there are five significant 
singular causal factors: “Adverse Mental State, Skill-Based Errors, Decision Errors, Crew 
Resource Management and Organizational Process.” These five causal factors all had the 
highest probability of occurrence when compared with other causal factors. Looking at 
combinations of causal factors (Appendix B) only two significant combinations, 
“Adverse Mental State and Skill-Based Errors” and “Adverse Mental State and Crew 
Resource Management” exist. There are two recommendations for intervention that are 
discussed in the following paragraphs, each from a different point of view for HE 
intervention. 

If the viewpoint of removing a single causal factor (the Domino theory) is the 
basis of the recommendation, then there would be five points of intervention: “Adverse 
Mental State, Skill-Based Errors, Decision Errors, and Organizational Process.” In the 
case of “Crew Resource Management,’ the NSC has already developed a program for NA 
to increase the awareness of “Crew Resource Managements” importance in NA. Taking 
the other four causal factors, the expected mean value for accidents/100,000 flight hours 


are listed in Table 9 along with a 50 percent intervention FM reduction for discussion. 
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Table 9. Mean accidents/100,000 flight hours predicted in simulation for significant 
single causal factors. Example: it is predicted that 2.179 FMs/100,000 flight hours will 
cite Adverse Mental State as a causal factor. 











Mean/100.000 flight hours 50% reduction 
2.179 1.090 
1.950 0.975 
1.768 0.884 





Adverse Mental State 
Skill-Based Error 
Decision Error 
Organizational Process 


Looking at Adverse Mental State in Table 9, as an example, the Navy should 
develop a program to intervene and educate aviators to the hazards of Adverse Mental 
State. If the program were 50 percent successful in intervention, the expected reduction 
in accidents would be 1.090 FMs/100,000 flight hours. Using the TACAIR flight hours 
for FY98, the expected reduction in FMs would be 4.453 FMs. At an average cost of $22 
million per FM for FY98 (Gaynor, 1999), that would be an approximate $98 million 
savings for that fiscal year. 

An observation can be made concerning single point intervention using the current 
“Crew Resource Management” program effect on FMs. By FY94, the Navy had 
established a program to increase awareness of “Crew Resource Management” and had 
widely disseminated the program to all Naval squadrons to implement in their safety 
training programs. Taking the HFACS data and looking at the rates of “Crew Resource 
Management” from FY94 to FY97 (Figure 7), there has not been a significant decline in 
the rate of “Crew Resource Management.” Looking at the accident data for FY98, one 
sees that the data is incomplete, and does not contain a full account of causal factors for 
the 12 FMs during FY98. The current (though incomplete) “Crew Resource 
Management” arrival rate of 1.23 FMs/100,000 flight hours is not significantly below the 
“Crew Resource Management” average of 1.412 FMs/100,000 flight hours from FY94 to 
FY97. In five years of intervention, no significant change in the rate of “Crew Resource 
Management” being cited as a causal factor in Naval TACAIR FMs has occurred. 

The second viewpoint of intervention is that it is not sufficient at a single point, 


for HE needs to be considered as a complex web of interwoven causal factors (Figure 5). 
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The results of the analysis for the HFACS causal factors in TACAIR FMs from FY90 to 
FY97 highlight one significant causal factor, “Adverse Mental State.” Taking the two 
statistically significant combinations of causal factors, the mean accidents/100,000 flight 
hours are listed in Table 10 along with a 50 percent intervention result. Consider the 
combination of “Adverse Mental State and Skill-Based Error’ in Table 10. As an 
example, the Navy must develop a program to intervene at both these levels in 
combination. If the program is 50 percent successful, the expected reduction in accidents 
would be 0.727 FMs/100,000 flight hours. Using the TACAIR flight hours for FY98, the 
expected reduction would be 2.97 FMs. At an average cost of $22 million per FM for 
FY98 (Gaynor, 1999), that would be an approximate $65 million savings for that fiscal 


year. 


Rate 





FY90 to FY98 Class A and B TACAIR CRM Error Rate/100,000 Flight Hours 


FY-91 FY-93 FY-94 FY-95 FY-96 FY-97 FY-98 


Figure 7. Crew Recorce Management (CRM) arrival rate per 100,000 flight hours for 
FY90 to FY98. FY98 has incomplete data due to some MIRs not being fully completed 
for the year. Example: for FY94 CRM, HEs occurred in 1.15 FMs/100.000 flight hours. 
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Table 10. Mean accidents/100.000 flight hours predicted in simulation for significant 
combinations of causal factors. 











Mean/100,000 flight hours 50% reduction 


Adverse Mental State/Skill-Based Error 
Adverse Mental State/CRM 


In reality, due to the complexity and interactions among different types of HE, 
predicting the reduction of HE is quite difficult. This complexity therefore should point 
to the development of a program that is as encompassing as possible. The program 
should cover many aspects of HE, while keeping the size of the program moderate and 
economical. The development time, maintenance requirements of the program and the 
time required to train aviators in the new program should be reasonable. The program 
should be a one- to two-hour program, providing annual or semi-annual presentations to 
aviators so they can maintain awareness of the program issues. Given the strong 
relationships exhibited by Adverse Mental State with the majority of the other causal 
factors in the HFACS taxonomy, focusing on an FM awareness program for Adverse 
Mental State would be a proper choice. Since Adverse Mental State is intertwined with 
sO many other causal factors, intervention at Adverse Mental State would be expected to 
have the best chance of reducing FMs because of Adverse Mental State’s important 
entanglements with multiple causal factors. This entangled relationship would give a FM 
reduction program that focused on Adverse Mental State the best chance of completely 
breaking the chain of events leading to a FM. Compared with an intervention program 
that focus’s on a significant single causal factor, not having this entangled relationship 
with other causal factors, intervention at Adverse Mental State would be the obvious HE 
choice on which to focus in the development of a program to reduce human error FMs in 


Naval Aviation TACAIR. 


APPENDIX A. CORRELATION MATRICES FOR MATRICES HFACSA, 
HFACSB, AND HFACSC 
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APPENDIX B. S-PLUS SIMULATION CODE 


hfacsprogram2 <- 
Function (mtrix, catvector, lambda,time,iterations,mishaps) { 


counter <- rep(0,iterations) 
poissen <- rep(0,iterations) 
eouncer- data <= 0 

for (san li vecorations) { 


#generate number of accidents E(count accidents) = lambda*time 
randompoisson <- rpois(1,lambda*time) 
poisson[{i] <- randompoisson 
#generate random uniform selection of actual HFACS accident 
randomuniform <- round (runif (randompoisson,1,mishaps) ) 
#generate matrix of randomly selected accidents 
acc.data <- mtrix[{randomuniformn, ] 
acc.matrix <- as.matrix(acc.data) 
solution.data <- catvector%*%t(acc.matrix) 
count.data <- sum(solution.data == sum(catvector) ) 
counter [me<— ccountedata 
} 
print (mean (counter) ) 
prant (quantile (poisson, .02Z5) ) 
print (quantile (poisson, .975)) 
prime (quantile (counter, .025)) 
Deine (quantile (countex, .975) ) 
data.frame (poisson, counter) 
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APPENDIX C. MEAN AND 95 PERCENT CI FOR SIMULATION RUNS 
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APPENDIX D. CAUSAL FACTOR RATE/100,000 FLIGHT HOURS 
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APPENDIX E. KEY TO HFACS CODING A, ... ,Y 
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HFACS Causal Factor 

Unsafe Acts 

Preconditions for Unsafe Acts 
Unsafe Supervision 

Organizational Influence 

Errors 

Violations 

Substandard Conditions of Operators 
Substandard Practices of Operators 
Skill-Based Errors 

Decision Errors 

Perceptual Errors 

Infraction 

Exceptional 

Adverse Physiological State 
Adverse Mental State 
Physical/Mental Limitation 

Crew Resource Management (CRM) 
Personal Readiness 

Inadequate Supervision 

Planned Inappropriate Operations 
Failed to Correct Problem 
Supervisory Violations 

Resource Management 
Organizational Climate 


Organizational Process 
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APPENDIX F. EXCERPT FROM OPNAV 3750.6R (APPENDIX O) HFACS 
TAXONOMY 


Human Factors Analysis and Classification System (HFACS) 


Drawing upon Reason’s (1990) concept of latent and active failures, a framework 
was developed to identify the “holes” called the Human Factors Analysis and 
Classification System (HFACS). HFACS describes four levels of failure: 1) Unsafe Acts, 
2) Preconditions for Unsafe Acts, 3) Unsafe Supervision, and 4) Organizational 
Influences. A brief description of the major components and causal categories follows, 
beginning with the level most closely tied to the accident, unsafe acts. 

1. Unsafe Acts 

The unsafe acts committed by aircrew generally take on two forms, errors and 
violations. The first, errors, are not surprising given the fact that human beings by their 
very nature make errors. Consequently, aircrew errors are seen in most FMs — often as 
that last fatal flaw before a FM occurs. Violations, on the other hand, represent the 
willful disregard for the rules and typically occur less frequently. Still, not all errors are 
alike. Likewise, there are different types of violations. As such, the unsafe acts aircrew 
commit can be classified among three basic error types (skill-based, decision, and 
perceptual) and two forms of violations (infractions and exceptional). Each will be 
described in turn (Figure 2). 

Using this simple classification scheme, the investigator must first decide if an 
unsafe act (active failure) was committed by the operator (aircrew, maintainer, etc.). If 
so, the investigator must then decide if an error occurred or a rule was willfully violated. 
Once this is done, the investigator can further define the causal factor as a specific type of 
error or violation as described below. 

Error 

Skill-based Errors. Skill-based behavior is best described as those “stick-and- 
rudder’ and other basic flight skills that occur without significant conscious thought. As 


a result, skill-based actions are particularly vulnerable to failures of attention and/or 
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memory. In fact, attention failures have been linked to many skill-based errors such as 
the breakdown in visual scan patterns, task fixation, the inadvertent activation of controls, 
and the misordering of steps in a procedure, among others (Table 1). Consider, for 
example, the pilot so intent on putting bombs on target that he disregards his low altitude 
warming only to collide with the ground. Closer to home, have you ever locked yourself 
Out of your car or missed your exit because your were either distracted, in a hurry, or 
daydreaming? These are all examples of attention failures that occur during highly 
automatized behavior. While on the ground they may be frustrating, in the air they can 
become catastrophic. 

In contrast to attention failures, memory failures often appear as omitted items in 
a checklist, place losing, or forgotten intentions. For example, most of us have 
experienced going to the refngerator only to forget what we came for. Likewise, it is not 
difficult to imagine that in emergency situations, when under stress, steps in boldface 
emergency procedures or radio calls can be missed. Even when not particularly stressed 
however, individuals have forgotten to set the flaps on approach or lower the landing 
gear. 

Skill-based errors can happen even when no apparent attention of memory failure 
is present. The individual flying skill/techniques of Naval aviators differ from one pilot 
to the next. We have all known individuals that fly smooth and effortless and those who 
make every mission an adventure. It is the skill-based errors of the latter that often leads 
to FMs as well. The bottom line is that skill-based errors are unintended behaviors. That 
is, individuals typically do not choose to limit their scan patterns, forget a boldface 
procedure, or fly poorly — it just happens, unbeknownst to the individual. 

Decision Errors. The second error form, decision errors, represent intentional 
behavior that proceeds as intended, yet the plan proves inadequate or inappropriate for the 
situauon. Often referred to as “honest mistakes’, these unsafe acts represent the actions 
or inaction of individuals whose heart is in the night place, but they either did not have the 
appropriate knowledge available or just simply chose poorly. Regardless of the outcome, 


the individual made a conscious decision. 
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Decision errors come in many forms, and occur for a variety of reasons. 
However, they typically represent poor decisions, improper procedural execution, or the 
misinterpretation or misuse of relevant information (Table 1). The bottom line is that for 
good or bad the individual made a conscious choice and elected to do what was done in 
the cockpit — unfortunately, in the case of FMs, it did not work. 

Perceptual_Errors. Not surprisingly, when your perception of the world is 
different then reality, errors can, and often do, occur. Typically, perceptual errors occur 
when sensory input is degraded or ‘unusual’, as is the case when visual illusions or spatial 
disorientation occurs (Table 1). Visual illusions occur when the brain tries to ‘fill in the 
gaps’ with what it feels belongs in a visually impoverished environment, like that seen at 
night or in the weather. Likewise, spatial disorientation occurs when the vestibular 
system cannot resolve your orientation in space and therefore makes a “best guess” — 
typically when visual (horizon) cues are absent at night or in weather. In either event, the 
individual is left to make a decision based on faulty information leading to and error, and 
often a FM. Likewise, it is often quite difficult to judge precise distance and closure 
between aircraft and the ground when relative cues like clouds or terrain features are 
absent. Consequently, aircrews are left to make control inputs based upon misperceived 
or absent information. Tragically, these sorts of errors often lead to midair collisions or 
controlled flight into terrain. 

Violations 

Routine/Infractions. Violations in general are the willful departure from authority 
that simply cannot be tolerated. We have identified two distinct types of violations 
(Table 1). The first, infractions, tend to be routine/habitual by nature constituting a part 
of the individual’s behavioral repertoire. For example, the individual that drives 
consistently 5-10 mph faster than allowed by law. While certainly against the law, many 
folks do it. Furthermore, if you go 64 in a 55 mph zone, you always drive 64 in a 55 mph 
zone. That is, you ‘routinely’ violate the law. Commonly referred to as “bending” the 
rules, these violations are often tolerated and, in effect, sanctioned by supervisory 


authority (that 
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Table 1. Selected examples of Unsafe Acts of Operators (Note: this is not a complete listing) 


Unsafe Acts of Operators 
Errors Violations 


Skill-based Errors 


Breakdown in Visual Scan 
Delayed Response 

Failed to Prioritize Attention 
Failed to Recognize Extremis 
Improper Instrument Cross-Check 
Inadvertent use of Flight Controls 
Omitted Step in Procedure 
Omitted Checklist Item 

Poor Technique ~ 


Decision Errors 


Improper Takeoff 

Improper Approach/Landing 
Improper Procedure 
Misdiagnosed Emergency 
Wrong Response to Emergency 
Exceeded Ability 

Inappropriate Maneuver 

Poor Decision 


Perceptual Errors 
Misjudged Distance/Altitude/Airspeed 


Spatial Disorientation 
Visual Illusion 


Routine (Infractions) 
Failed to Adhere to Brief 


Violation of Naval NATOPS/Regulations/SOP 
- Failed to use RADALT 
- Flew an unauthorized approach 
- Failed to execute appropriate rendezvous 
- Violated training rules 
- Failed to adhere to departure procedures 
- Flew overaggressive maneuver 
- Failed to properly prepare for flight 
- Failed to comply with NVG SOP 


Exceptional 
Briefed Unauthorized Flight 


Not Current/Qualified for Mission 
Intentionally Exceeded the Limits of the Aircraft 
Violation of Naval NATOPS/Regulations/SOP 
- Continued low-altitude flight in VMC - 
Failed to ensure compliance with rules 
Unauthorized low-altitude canyon running 
Not current for mission 
Flathatting on takeoff 
- Bnefed and flew unauthorized maneuver 





is, you are not likely to get a ticket going 64 in a 55). If however, the local authorities 
started handing out tickets for exceeding the speed limit on the highway by 9 mph (like is 
often done on military installations) then it is less likely that individuals would violate the 
rules. Therefore, by definition, if a routine violation/infraction is identified, one must 


look further up the supervisory chain to identify those that are condoning those violations. 
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Exceptional. Unlike routine violations, exceptional violations appear as isolated 
departures from authority, not necessarily indicative of an individual’s typical behavior 
pattern nor condoned by management. For example, an isolated instance of driving 105 
mph in a 55 mph zone, or in Naval Aviation, flathatting, is considered an exceptional 
violation. It is important to note that while most exceptional violations are heinous, they 
are not considered ‘exceptional’ because of their extreme nature. Rather, they are 
considered exceptional because they are neither typical of the individual nor condoned by 
authonity. 

2. Preconditions for Unsafe Acts 

Arguably, the unsafe acts of operators can be directly linked to nearly 80 percent 
of all Naval Aviation FMs. However, simply focusing on unsafe acts is like focusing on 
a fever without understanding the underlying disease causing it. As such, investigators 
must dig deeper into why the unsafe acts took place. As a first step, we describe two 
major subdivisions of unsafe aircrew conditions, each with their specific causal 
categories. Specifically, they include the Substandard Conditions of operators (..e., 
Adverse Mental States, Adverse Physiological States, and Physical/Mental Limitations) 
as well as those Substandard Practices they commit. Each are described briefly below. 

Substandard Conditions of Operators 

Adverse Mental States. Being prepared mentally is critical in nearly every 
endeavor, perhaps more so in aviation. As such, the category of adverse mental states 
was created to account for those mental conditions that affect performance (Table 2). 
Principle among these is the loss of situational awareness, task fixation, distraction, and 
mental fatigue due to sleep loss or other stressors. Also included in this category are 
personality traits and pernicious attitudes such as overconfidence, complacency, and 
misplaced motivation. For example, if an individual is mentally tired for whatever 
reason, the likelihood that an error would occur increases. Likewise, overconfidence, 
arrogance, and other pernicious attitudes will influence the likelihood that a violation is 
committed. While errors and violations are important causal factors, adverse mental 


states such as these are no less important, perhaps even more so, in the causal sequence. 
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Adverse Physiological States. The second category, adverse physiological states, 
refers to those medical or physiological conditions that preclude safe operations (Table 
2). Particularly important to Naval Aviation are conditions such as spatial disorientation, 
visual illusions, G-induced loss of consciousness (G-LOC), hypoxia, physical fatigue, and 
the myriad of pharmacological and medical abnormalities known to affect performance. 
If, for example, an individual were suffering from an inner ear infection, the likelihood of 
Spatial disorientation occurring when entering IMC goes up markedly. Consequently, the 
medical condition must be addressed within the causal chain of events. 

Physical/Mental_ Limitations. The third, and final, category of Aeromedical 
Conditions, Physical/Mental Limitations, refers to those instances when the mission 
requirements exceed the capabilities of the individual at the controls. Physical/Mental 
Limitations can take many forms (Table 2). For example, at night our visual systems are 
limited by the capability of the photosensors in our eyes and hence vision is severely 
degraded. Yet, like driving a car, we do not necessarily slow down or take additional 
precautions. In aviation, this often results in not seeing other aircraft, obstacles, or power 
lines due to the size or contrast of the object in the visual field. Similarly, there are 
occasions when the time required to complete a task or maneuver exceeds human 
capacity. It is well documented that if individuals are required to respond quickly (..e., 
less time is available to consider all the possibilities or choices thoroughly), the 
probability of making an error goes up markedly. 

There are two additional instances of physical/mental limitations that need to be 
addressed; albeit they are often overlooked in most FM investigations. They involve 
individuals who simply are not compatible with aviation. For example, some individuals 
simply do not have the physical strength to operate in high-G environments or for 
anthropometric reasons simply have difficulty reaching the controls. In other words, 
cockpits have traditionally not been designed with all shapes, sizes, and physical abilities 
in mind. Likewise, not everyone has the mental ability or aptitude for flying Naval 


aircraft. Just as not all of us can be concert pianists or NFL lincbackers, we cannot all fly 
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Naval aircraft. The hard part is identifying whether this might of played a role in the FM 
Causal sequence. 

Substandard Practices of Operators 

Crew Resource _Mismanagement. To account for occurrences of poor 
coordination among aircrew and other personnel associated with the safe conduct of the 
flight, the category of crew resource management was created (Table 2). This includes 
coordination both within and between aircraft, ATC, and maintenance control, as well as 
facility and other support personnel. Anywhere communication between individuals is 
required, the potential for miscommunication, or simply poor resource management, 
exists. However, aircrew coordination does not stop with the aircrew in flight. It also 
includes coordination before and after the flight with the brief and debrief of the aircrew. 
Literally volumes have been written on the topic, yet it continues to permeate both fixed- 
wing and rotary-wing aviation, as well as multi-crew and single-seat aircraft. The 
conscientious investigator must always be aware of the potential for poor CRM practices. 

Personal Readiness. In aviation, or for that matter in any occupational setting, 
individuals are expected to show up for work ready to perform at optimal levels. For 
Naval Aviation however, personal readiness failures occur when individuals fail to 
prepare physically or mentally for flight. For instance, violations of crew rest 
requirements, bottle-to-brief rules, and self-medicating all will affect performance in the 
aircraft. It is not hard to imagine that when you violate crew rest requirements, you run 
the risk of mental fatigue and other adverse mental states. (Note that violations that effect 


personal 
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Table 2. Selected examples of Unsafe Aircrew Conditions (Note: this is not a complete 
listing) 


Preconditions for Unsafe Acts 


Aeromedical Crew Resource Management 
Adverse Mental States Failed to Back-up 
Channelized Attention Failed to Communicate/Coordinate 

























Complacency Failed to Conduct Adequate Brief 
Distracted Failed to Use All Available Resources 
Mental Fatigue Failure of Leadership 

Get-home-it is Misinterpretation of Traffic Calls 
Haste Trans-cockpit Authority Gradient 


Life Stress 
Loss of Situational Awareness 
Misplaced Motivation 

Task Saturation 













Personal Readiness 

Excessive Physical Training 
Self-Medicating 

Violation of Crew Rest Requirement 
Violation of Bottle-to-Bnef Requirement 














Adverse Physiological States 
G-Induced Loss of Consciousness 


Impaired Physiological State 
Medical IIness 

Physiological Incapacitation 
Physical Fatigue 





Physical/Mental Limitation 
Insufficient Reaction Time 


Visual Limitation 
Incompatible Intelligence/Aptitude 
Incompatible Physical Capability 


readiness are not considered “unsafe act, violation” since they typically do not happen in 
the cockpit, nor are they active failures with direct and immediate consequences) 

Still, not all personal readiness failures occur as a result of violations of rules. For 
example, running 10 miles before piloting an aircraft may not be against any existing 
regulations, yet it may impair the physical and mental capabilities of the individual 
enough to degrade performance and elicit unsafe acts. Likewise, the traditional “candy 
bar and coke” lunch of the naval aviator may sound good but may not be sufficient to 
sustain performance in the rigorous environment of military aviation. Even cramming for 


exams may significantly impair your sleep and may in some cases influence your 
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performance the next day in the cockpit. While, there may be no rules governing such 
behavior, aircrew must be their own best judge. Certainly, additional education and 
physical exercise is a good thing when taken in moderation, but aircrew must always 
assess their condition objectively before manning the aircraft. 

3. Unsafe Supervision 

It is the experience of the NSC that often the FM causal chain of events can be 
traced back up the supervisory chain of command. As such, we have identified four 
categories of Unsafe Supervision: Inadequate Supervision, Planned Inappropriate 
Operations, Failed to Correct a Known Problem, and Supervisory Violations. Each are 
described briefly below. 

Inadequate Supervision. The role of any supervisor is to provide the opportunity 
to succeed. To do this the supervisor, no matter what level he operates at, must provide 
guidance, training opportunities, leadership, motivation, and the proper role model. 
Unfortunately, this is not always the case. It is not difficult to conceive of a situation 
where adequate crew resource management training was either not provided, or the 
Opportunity to attend was not afforded, to a particular aircrew member. Conceivably, his 
aircrew coordination skills would be compromised and if put into an adverse situation (an 
emergency for instance), he would be at risk for errors and potentially a FM. Therefore, 
the category Inadequate Supervision was created to account for those times when 
supervision proves inappropriate, improper, or may not occur at all (Table 3). 

Planned Inappropriate Operations. Occasionally, the operational tempo and/or 
schedule is planned such that individuals are put at unacceptable risk, crew rest is 
jeopardized, and ultimately performance is adversely affected. Such operations, though 
arguably unavoidable during emergency situations, are unacceptable during normal 
Operations. Therefore, we have created a second category, Planned Inappropriate 
Operations, to account for these supervisory failures (Table 3). Included in this category 
are issues of crew pairing and improper manning. It’s not surprising to anyone that when 
two individuals with marginal skills are paired together, problems can, and often do, 


arise. With downsizing and the current level of operational commitments, it is difficult to 
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manage crews. However, pairing two weak or inexperienced aircrew together on the 
most difficult mission may not be prudent. 

Failure_to_ Correct _a_ Known Problem. The third category of known unsafe 
supervision, Failed to Correct a Problem, refers to those instances when deficiencies 
among individuals, equipment, training or other related safety areas are “known” to the 
supervisor, yet are allowed to continue uncorrected (Table 3). For example, the failure to 
consistently correct or discipline inappropriate behavior certainly fosters an unsafe 
atmosphere, but is not considered a violation if no specific rules or regulations were 
broken. 

Supervisory Violations. Supervisory violations, on the other hand, are reserved 
for those instances when existing rules and regulations are willfully disregarded by 
Supervisors when managing assets (Table 3). For instance, permitting an individual to 
operate an aircraft without current qualifications or license is a flagrant violation that 
invariably sets the stage for the tragic sequence of events that predictably follow. 

4. Organizational Influences 

Fallible decisions of upper-level management directly effect supervisory practices, 
as well as the conditions and actions of operators. These latent failures generally revolve 
around issues related to resource management, organizational climate, and operational 
processes. 

Resource Management. This category refers to the management, allocation, and 
maintenance of organizational resources, such as human, monetary, and 
equipmenvt/facilities. The term ‘human’ refers to the management of operators, staff, and 
maintenance personnel. Issues that directly influence safety include selection (including 
background checks), training, and staffing/manning. Monetary issues refer to the 


management of non-human resources, primarily monetary resources. For example, 
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Table 3. Selected examples of Unsafe Supervision (Note: this is not a complete listing) 
Inadequate Supervision Failed to Correct a Known Problem 
Failed to Provide Guidance Failed to Correct Document in Error 
Failed to Provide Operational Doctrine Failed to Identify an At-Risk Aviator 
Failed to Provide Oversight Failed to Initiate Corrective Action 
Failed to Provide Training Failed to Report Unsafe Tendencies 
Failed to Track Qualifications 
Failed to Track Performance 




























Supervisory Violations 
Authorized Unnecessary Hazard 


Failed to Enforce NATOPS/Regs/SOP 
Failed to Enforce T&R Manual 
Authorized Unqualified Crew for Flight 














Planned Inappropriate Operations 
Failed to Provide Correct Data 


Failed to Provide Adequate Brief Time 

Improper Manning 

Mission Not IAW with NATOPS/Regs/SOP 

Permitted Unnecessary Hazard 

Provided Inadequate Opportunity for Crew 
Rest 





excessive cost cutting, a lack of funding for proper and safe equipment and resources both 
have adverse effects on operator performance and safety. Finally, Equipment/Facility 
refers to issues related to equipment design, including the purchasing of unsuitable 
equipment, inadequate design of work spaces, and failures to correct known design flaws. 
Management should ensure that human factors engineering principles are known and 
utilized and that specifications for equipment and workspace design are identified and 
met. 

Organizational Climate. Organizational climate refers to a broad class of 
organizational variables that influence worker performance (Glick, 1985). It can be 
defined as the “situationally based consistencies in the organization’s treatment of 
individuals.” (Jones, 1988). In general, organizational climate is the prevailing 
atmosphere or environment within the organization. Within the present classification 
system, climate is broken down into three categones- structure, policies, and culture. The 
term ‘structure’ refers to the formal component of the organization (Mintzberg, 1993). 
The “form and shape” of an organization are reflected in the chain-of-command, 


delegation of authority 


a 





Table 4. Selected examples of Organizational Influences(Note: this is not a complete listing) 


Resource/Acquisition Management Organizational Process 
Human Resources Operations 












































Selection Operational tempo 
Staffing/Manning Time pressure 
Training Production quotas 



























Monetary/Budget Resources Incentives 

Excessive cost cutting Measurement/Appraisal 

Lack of funding Schedules 

Equipment/Facility Resources Deficient planning 

Poor design Procedures 

Purchasing of unsuitable equipment Standards 

Clearly defined objectives 

Organizational Climate Documentation 

Structure Instructions 

Chain-of-command Oversight 

Delegation of authority Risk Management 

Communication Safety Programs 

Formal accountability for actions 

Policies 

Hiring and firing 

Promotion 

Drugs and alcohol 

Culture 


Norms and rules 
Values and beliefs 
Organizational justice 
Citizen behavior 
and responsibility, communication channels, and formal accountability for actions. 
Organizations with maladaptive structures (i.e., do not optimally match to their 
operational environment or are unwilling to change), will be more prone to accidents and 
“will ultimately cease to exists.” (Muchinsky, 1997). Policies refer to a course or method 
of action that guides present and future decisions. Policies may refer to hiring and firing, 
promotion, retention, raises, sick leave, drugs and alcohol, overtime, accident 
investigations, use of safety equipment, etc. When these policies are ill defined, 
adversarial, or conflicting, safety may be reduced. Finally, culture refers to unspoken or 


unofficial rules, values, attitudes, beliefs, and customs of an organization. “The way 
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things really get done around here.” Other issues related to culture included 
organizational justice, psychological contracts, organizational citizenship behavior, esprit 
de corps, and union/management relations. All these issues affect attitudes about safety 
and the value of a safe working environment. 

Operational Process. This category refers to the formal process by which things 
are done in the organization. It is subdivided into three broad categories - operations, 
procedures, and oversight. The term ‘operations’ refers to the characteristics or conditions 
of work that have been established by management. These characteristics included 
operational tempo, time pressures, production quotas, incentive systems, schedules, etc. 
When set up inappropriately, these working conditions can be detrimental to safety. 
Procedures are the official or formal procedures as to how the job is to be done. 
Examples include performance standards, objectives, documentation, instructions about 
procedures, etc. All of these, if inadequate, can negatively impact employee supervision, 
performance, and safety. Finally, oversight refers to management’s monitoring and 
checking of resources, climate, and processes to ensure a safe and productive work 
environment. Issues here relate to organizational self-study, risk management, and the 


establishment and use of safety programs. 
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